How to prevent a specific directory from running Php, Html, and Javascript languages?

Question

Hi, Let's say i have an image uploader script, i want to prevent the upload directory from executing Php or even html by only showing it as plain text, i've seen this trick in many websites but i don't know how they do it.

Briefly, if i upload evil.php to that directory, and i try to access it i will only see a plain text source , No html or php is executed. ( but i still want the images to appear normally ofcourse)

I know i can do like that by header("content-type:text/plain"); but that's will not be helpful, because what i want, is to set the content-type:text/plain automatically by the server for every thing outputed from the upload directory except images.

Note: i'm running php 5.3.2/Cent OS and the latest cPanel.

Thanks

Answer 1

At the very least, you'll want to put the following in your .htaccess file for the upload directory:

Options -Indexes
Options -ExecCGI
AddHandler cgi-script .php .php3 .php4 .phtml .pl .py .jsp .asp .htm .shtml .sh .cgi

Answer 2

Put a .htaccess in the upload directory.

AddType 'text/plain' .php .html

or

ForceType 'text/plain'
#...

Answer 3

Since you're talking about an image uploader, you don't want to display images as plain/text. How would you separate images from malicious files? During that task, just block saving the particular file.

Answer 4

Do a Google search for "disable script execution for directory" to turn up a number of options. This one is my favorite:

AddType text/plain .html .htm .shtml .php .php3 .phtml .phtm .pl .py .cgi .js

The only downside is that you have to explicitly name the extensions not to run, but it may be possible (just a hunch) to use some sort of wild card so that all file extensions are considered plain text, and then manually add the Mime Type for your standard image extensions.