Change the 'security level' of registry entries to PHP_INI_SYSTEM. They're

in the system hive in the registry, so only people with administrative
priveleges can add stuff in there.

NEWS

@@ -1,6 +1,9 @@
 PHP 4                                                                      NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ? ? ??? 2002, Version 4.3.0
+- Changed registry entries under "HKLM\SOFTWARE\PHP\Per Directory Values" to
+  work also with administrative directives such as safe_mode, open_basedir,
+  etc. (Claudio Felber) 
 - Added PGSQL_CONNECT_FORCE_NEW option to pg_connect() (Yasuo)
 - ATTENTION! "make install" will *by default* install the CLI SAPI binary in 
   {PREFIX}/bin/php. If you don't disable the CGI binary, it will be

win32/registry.c

@@ -70,7 +70,7 @@ void UpdateIniFromRegistry(char *path TSRMLS_DC)
 				RegEnumValue(hKey, i, namebuf, &namebuf_len, NULL, &lType, valuebuf, &valuebuf_len);
 
 				if ((lType == REG_SZ) || (lType == REG_EXPAND_SZ)) {
-					zend_alter_ini_entry(namebuf, namebuf_len + 1, valuebuf, valuebuf_len, PHP_INI_PERDIR, PHP_INI_STAGE_ACTIVATE);
+					zend_alter_ini_entry(namebuf, namebuf_len + 1, valuebuf, valuebuf_len, PHP_INI_SYSTEM, PHP_INI_STAGE_ACTIVATE);
 				}
 
 				i++;