Home/ Questions/Q 726535
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-14T06:27:47+00:00

Let’s say i have an image uploader script, i want to prevent the upload

  • 0

Let’s say i have an image uploader script, i want to prevent the upload directory from executing Php or even html by only showing it as plain text, i’ve seen this trick in many websites but i don’t know how they do it.

Briefly, if i upload evil.php to that directory, and i try to access it i will only see a plain text source , No html or php is executed. ( but i still want the images to appear normally ofcourse)

I know i can do like that by header("content-type:text/plain"); but that’s will not be helpful, because what i want, is to set the content-type:text/plain automatically by the server for every thing outputed from the upload directory except images.

Note: i’m running php 5.3.2/Cent OS and the latest cPanel.

Thanks

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    At the very least, you’ll want to put the following in your .htaccess file for the upload directory:

    Options -Indexes
Options -ExecCGI
AddHandler cgi-script .php .php3 .php4 .phtml .pl .py .jsp .asp .htm .shtml .sh .cgi

    The problem with an .htaccess file is if your upload does not block the upload, your .htaccess can be overwritten. An alternative solution is using an Apache directive (if you are using Apache) shown here, Disable PHP in directory (including all sub-directories) with .htaccess

    • 0