open_basedir multisite security

Hi, hope this is not the wrong place to ask...

I read through most of the multisite relevant info here and elsewhere, there are many interesting posts that help a lot getting familiar with that very interesting feature of Drupal.

However, I am stuck at the fact, that an Administrator of a site will always be able to post php as content for a node - I can not find a configuration item that would prevent this.