It's possible that this might mirror something I was doing a couple of years ago and I preface this with the observation that I don't believe that it was good practice, but I didn't find a way around it, so I welcome any correction.
The issue (in my case) was that running a python program that accessed the GPIO pins required root access. If you are going to execute a python file from PHP, then the user that calles the PHP file will require root (sudo permission) access.
For my part that involved (and here I am paraphrasing to reflect your example) creating a php file that executes the python script similar to;
echo exec( 'sudo python /var/www/LED-on.py' );
Change the permissions for the python file so that the web user 'www-data' has permissions for the files
sudo chown www-data:pi /var/www/LED-on.py
give the www-data user the ability to run python scripts as root (this is the ugly part)
www-data ALL=(ALL) NOPASSWD: /usr/bin/python under the
# User privilege specification area
It's not secure, but it worked. I would appreciate any advice that would make it better for myself or the OP.
To try and make myself feel better about it I added password protection using 'Web Page Password Protect' by downloading the script from 'http://www.zubrag.com/scripts/password-protect.php', putting it in the same directory as the php file and adding the following line to the top of the .php file;