Well, one would hope that Apache is at least running scripts as a non-privileged account. I had the misfortune recently to come across an Apache installation on one of our Solaris boxes that was running scripts as root. A quick phone call to the sysadmin followed by some httpd.conf tweakage soon cleared that one up thankfully ;-)