Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a sub-directory within the html/ doc root that users need to upload images to. I need to set up something so that no scripts (php) can be executed within this directory. There will be multiple users uploading images to this directory but just in case one of their accounts is compromised I'd like to add some added protection so that a malicious script cannot be executed. The directory is only for serving up images. Any suggestions?

share|improve this question

You want something like:

<Directory /foo/bar>
  [other directives for this dir]
  AddHandler default-handler .php 
share|improve this answer

Fixed. I added the following new directory container to the Apache.conf file for the specific directory:

<Directory /www/sites/>
RemoveHandler .php .phtml .php3 .php5
RemoveType .php .phtml .php3 .php5
php_flag engine off


share|improve this answer

Use AddHandler in a <Directory> section to force PHP scripts to go through default-handler.

share|improve this answer
can you please clarify? – SoMoSparky Mar 12 '12 at 21:08
... Which part? – Ignacio Vazquez-Abrams Mar 12 '12 at 21:09

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.