How to prevent a specific directory from running Php, Html, and Javascript languages?

Question

Let's say i have an image uploader script, i want to prevent the upload directory from executing Php or even html by only showing it as plain text, i've seen this trick in many websites but i don't know how they do it.

Briefly, if i upload evil.php to that directory, and i try to access it i will only see a plain text source , No html or php is executed. ( but i still want the images to appear normally ofcourse)

I know i can do like that by header("content-type:text/plain"); but that's will not be helpful, because what i want, is to set the content-type:text/plain automatically by the server for every thing outputed from the upload directory except images.

Note: i'm running php 5.3.2/Cent OS and the latest cPanel.

Thanks

Answer 1

At the very least, you'll want to put the following in your .htaccess file for the upload directory:

Options -Indexes
Options -ExecCGI
AddHandler cgi-script .php .php3 .php4 .phtml .pl .py .jsp .asp .htm .shtml .sh .cgi

The problem with an .htaccess file is if your upload does not block the upload, your .htaccess can be overwritten. An alternative solution is using an Apache directive (if you are using Apache) shown here, Disable PHP in directory (including all sub-directories) with .htaccess