title: File upload security with Apache
body: <p>I believe the problem is pretty common: you want to allow users to upload their files to your server. One common technique to prevent security issue is to check the file extensions to prevent executable files.</p>
  
  <p>But that's pretty innocent, I believe. Users could, for example, upload a php text file so that it can simply print phpinfo(). And it shouldn't just be a problem of PHP - it can be any files that the server wants to execute automatically. </p>
  
  <p>So is there any way to config APACHE so that there's one safe directory (to store statically uploaded files) so that the files in this folder are safe enough not to be executable (which means that when users request such files, they are directly sent to the browsers without any side effect on the server)?</p>