Probably a security hole!

[kassah]

it's not a bad idea, I've always wondered about programs constantly putting their code in /var/www/ which is the default root directory of most apache servers by default. I would think this would be a liability if somehow the configs got reverted to package defaults without PHP (thus showing off php sources). I'd have to look it up, but I'd swear there was a case made public on slashdot where a company's records were put up for all the public to see because of a similar error to the case presented in my post.

This is why I've always used /srv for that, I have no idea if that's the "proper" use of that directory. It could be I'm ignorent and it's apart of the LSB spec.