How to safely prevent uploaded file from being run via PHP on any server?

Question

I noticed that it's possible to run a file via PHP even if its extension wasn't .php, for example file test.xyz.php.whatever.zyx can be still run with PHP even when the extension isn't .php! It just happens to have .php. in the filename, and that's enough for my Apache to run the PHP script.

I tried (as someone suggested) to put this in a .htaccess file on that folder:

php_flag engine off

But it didn't work on my machine.

The only solutions I know for now are:

• Rename to known file extension, which is not run via PHP, such as .txt.
• Remove all dots from the filename, thus making it extensionless.

But I'm still not sure how these solutions would work on other servers than my Windows server (with Apache).

Is there any other solutions which doesn't need the filenames to be renamed in any way?

Answer 1

for uploading by users I suggest that you upload a folder in a layer above the root path in this case Only You Have Access To upload folder( In direct addressing) and an attacker have not access to any files in this folder Thus you disable an attacker action to run malicious file