title: How to safely prevent uploaded file from being run via PHP on any server?
body: <p>I noticed that it's possible to run a file via PHP even if its extension wasn't <code>.php</code>, for example file <code>test.xyz.php.whatever.zyx</code> can be still run with PHP even when the extension isn't <code>.php</code>! It just happens to have <code>.php.</code> in the filename, and that's enough for my Apache to run the PHP script.</p>
  
  <p>I tried (as someone suggested) to put this in a <code>.htaccess</code> file on that folder:</p>
  
  <pre><code>php_flag engine off
  </code></pre>
  
  <p>But it didn't work on my machine.</p>
  
  <p>The only solutions I know for now are:</p>
  
  <ul>
  <li>Rename to known file extension, which is not run via PHP, such as <code>.txt</code>.</li>
  <li>Remove all dots from the filename, thus making it extensionless.</li>
  </ul>
  
  <p>But I'm still not sure how these solutions would work on other servers than my Windows server (with Apache).</p>
  
  <p>Is there any other solutions which doesn't need the filenames to be renamed in any way?</p>