title: Disable all CGI (php, perl, …) for a directory using .htaccess
body: <p>I have a directory where users can upload files.</p>
  
  <p>To avoid security issues (e.g. somebody uploading a malicious php script), I currently change the files' extension by appending <code>.data</code> for example, but then when downloading the file, they have to manually remove the <code>.data</code>.</p>
  
  <p>Another common solution is to upload the files in a directory that is not served by Apache, and <a href="https://stackoverflow.com/a/17949520/324969">have a php script manage all downloads</a> by calling <code>readfile()</code>.</p>
  
  <p>What I'd like to do is to simply disallow execution of any scripts (php, perl, cgi scripts, whatever I may install in the future) in the upload folder. <a href="https://stackoverflow.com/a/7454539/324969">This SO answer</a> suggests adding the following line in a <code>.htaccess</code> file in that folder:</p>
  
  <pre><code>SetHandler default-handler
  </code></pre>
  
  <p>However, in my case this has no effect (the example php script I put in that folder is still executed). What am I doing wrong?</p>
  
  <h1>Apache configuration</h1>
  
  <p>The machine is a VPS (Virtual Private Server) running <code>Debian GNU/Linux 6.0.7 (squeeze)</code>, and as far as I can remember (I note down all commands I run on that server, so my "memory" should be pretty accurate), I dindn't change anything in apache2 configuration, appart from running <code>sudo apt-get install php5</code>, and creating the the file <code>/etc/apache2/sites-enabled/mysite.com</code> with the following contents:</p>
  
  <pre><code>&lt;VirtualHost *:80&gt;
    ServerAdmin webmaster@localhost
    ServerName  mysite.com
    ServerAlias www.mysite.com
  
    DocumentRoot /home/me/www/mysite.com/www/
    &lt;Directory /&gt;
      Options FollowSymLinks
      AllowOverride All 
    &lt;/Directory&gt;
    &lt;Directory /home/me/www/mysite.com/www/&gt;
      Options Indexes FollowSymLinks MultiViews
      AllowOverride All 
      Order allow,deny
      allow from All
    &lt;/Directory&gt;
  
    ErrorLog ${APACHE_LOG_DIR}/error.log
  
    # Possible values include: debug, info, notice, warn, error, crit,
    # alert, emerg.
    LogLevel warn
  
    CustomLog ${APACHE_LOG_DIR}/access.log combined
  &lt;/VirtualHost&gt;
  </code></pre>