I'm tasked with maintaining a LAMP webserver that has been victimized already by some PHP programmers that have never heard of SQL injection, CSRF, or similar topics. There are several world-writable directories to which these PHP scripts are supposed to be used to upload images. Of course, they can also be used to upload PHP scripts, like web shells.
Is there an Apache module or directive that can turn off the PHP engine for any directory it encounters that is writable by apache?
safe_mode, ugly hack though it is, has been enabled on the sites in question. But beyond that I am refusing to take responsibility for auditing or touching a single line of these atrocious PHP scripts themselves.