Question

Is there a way, through php.ini or .htaccess to disable all file uploads to a server?

The only catch is, I want to have one folder (example an admin folder) to still have access to upload.

I am thinking along the lines of when you disable eval and exec.

This question stems from the fact that I have seen sites infected with malware, which are located in all random spots through the server – a recent example I have seen is something similar to:

eval(gzinflate(base64_decode("HZ3fdsfHjtfvdqlkdsfabf5Y7OAQfMCRc9YKaYc5o0mHOmmJ6+ .... ));

Located in a file called stp.php on a server. My thinking is that if the sites users need no access to upload files (which they don’t), then it should be simply disabled.

Answer 1

Yes. In your php.ini file set file_uploads=Off as described here.
This will disable all file uploads through HTTP.