title: PHP file manager upload / block PHP files
body: <p>I have searched various &quot;PHP upload security&quot; posts, especially in regards to blocking PHP files from being uploaded, but there does not seem to be a definite way to prevent disguised PHP files from getting uploaded from a &quot;filemanager&quot;-like application with file rename capabilities. Please correct me if I am wrong.</p>
  <p>Of course one can do checks on both <em>extension</em> and <em>mime</em> type on upload. However, user could easily upload &quot;index.html&quot; (containing some PHP) and then rename it to &quot;index.php&quot; from the filemanager, so this doesn't seem to offer much security. One could of course prevent renaming files to &quot;*.php&quot;, but that seems fragile at best.</p>
  <p>The ultimate solution of course is to disable PHP execution within directories where files are stored. However, the filemanager app will be distributed, and I can only <em>recommend</em> this to server owners, not enforce it.</p>
  <p>Any feedback appreciated. Just for reference, I am referring to a distributed PHP filemanager application, so I have no control of the server environment (apart from making recommendations). The filemanager allows renaming files, and users would generally want to upload most file types (excluding php).</p>