Turn safe mode on in php.ini. You can then turn it off and add open_basedir for each virtual account by modifying the new account creation script. If you leave safe mode off in php.ini and then use open_basedir, your server won't be safe as people can still access the dangerous PHP functions from a sub-domain.