The aim here is a security catch-all to disallow php execution of files created by the apache user (i.e. uploaded to a php script). Also we'd change the .html/.htm/.xhtml etc to text/plain to help protect against JS based attacks on other users.
<FileOwnerMatch apache> #Disable PHP execution #change mime types </FileOwnerMatch>
Can it be done?
NB We do check file extensions on uploads, but we'd like somethng akin to the above for added peace of mind.