How to prevent downloading a downloaded file?

Question

How can I prevent a downloaded file from starting? For example, someone can upload a php file and use it to hack a site, I want to prevent it.

Best of all, what I know is to use directory permissions and set it to 666?

Is there some htaccess magic I can do?

Answer 1

You can simply put .htaccess in your download folder with the following line:

php_flag engine off

It will disable PHP execution in this directory.

Edited to respond to comments: chmod 666 does not prevent PHP from executing. It just marks the files as non-executable, so you cannot run them directly as scripts or binary files. PHP does not care about file permissions; if it is readable, it will be parsed and executed by the engine.

Therefore, if your server has several engines (PHP, Jelly, whatever), you will have to manually create a configuration file that will prevent the interpretation of files in the folder. You can create a script that would generate this file based on which engines are installed on the machine.