Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to figure out which method I should use to control script/file execution security.

I'm trying to protect against malicious file upload/execution exploits where a user could potentially upload something bad and then execute it on my website.

What's the best way to protect against this? I only want certain files to be able to execute.

Should I consider taking a whitelist (only allow my files in a directory) or blacklist (based on file extension) approach?


share|improve this question
up vote 1 down vote accepted

You would need to post some more details.

When using Nginx for Zend Framework sites, I would whitelist index.php and serve 404 to any other .php file. This is fine for ZF as you only need to call the bootstrap and it handles all the other calls.

When working with a mainly static site, I've whitelisted the handful of PHP files (form processing on a contact form for example) that I know are on there.

On bigger sites which aren't using a bootstrap file, I've blacklisted any PHP files from the directories that are writeable by the Apache process, for example 'image-uploads' 'cache' etc.

I'm afraid the correct solution will depend on how your site is structured.

Why not post some more information?


share|improve this answer
My site is static. I have a few directories (sub-domains), each with a handful of php scripts and other files (.gif, .jpg, .png, .css, .js). Can you post an example of how you do it? Thanks! – Zero Oct 31 '10 at 6:14

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.