phhttpd assumes that anyone who can alter the config file has full control of the phhttpd universe. Do not let people alter the config file if they are not trusted. They could do all sorts of naughty things like bind to weird ports, inject Outrageously Huge filenames that phhttpd might not be happy to deal with, etc. Be Careful.