title: php file executed even without executable permissions
body: <p>On a website I give users option to upload files (and later download it).</p>
  
  <p>I uploaded a <code>hack.php</code> file and was surprised that I was able to execute it by just typing in the url in the browser.</p>
  
  <p>My permissions on the file a very strict. I don't want users to execute scripts that they upload. This is the relevant <code>ls -la</code> output:</p>
  
  <pre><code>-rwxr----- user apache hack.php
  </code></pre>
  
  <p>If I tighten permissions for the uploaded file to be:</p>
  
  <pre><code>-rwx------ user apache hack.php
  </code></pre>
  
  <p>Than the user can't download the file, because apache can't read it.</p>
  
  <p>The whole situation seem bizarre to me. I have given <code>hack.php</code> no executable permissions, yet I can still execute without any troubles. What am I missing here? </p>
  
  <p>In short, the main goal is to disable execution of any file of any sort that is uploaded to the server.</p>