I saw some people use this code in “.htaccess” to disable script execution:
<Files ~ “(php\.ini|\.htaccess|\.php.?|\.pl|\.cgi|\.spc|\.jsp|\.cfm|\.passwd)$”>
order deny,allow
deny from all
</Files>
But I think, this code is not secure at all. I bypass it by uploading a file with this name: “testpage.PhP”. (I tested it on my web hosting)
The problem is:
This code has a case sensitive regular expression.
Note: <FilesMatch> is similar to <Files> with this problem
One solution: use this code instead of that code:
# secure directory by disabling script execution
AddHandler cgi-script .php .pl .py .jsp .asp .htm .shtml .sh .cgi
Options -ExecCGI
Useful links:
http://www.askapache.com/htaccess/using-filesmatch-and-files-in-htaccess.html
http://blog.differentpixel.com/archives/198-Lots-of-.htaccess-tips,-tricks-and-hacks.html
http://perishablepress.com/press/2006/01/10/stupid-htaccess-tricks/
Cheers
Where is this supposed to be placed in the .htaccess file? If I put it at the top, then it prevents legitimate site visitors from executing PHP scripts such as email forms.
How to prevent access selectively once I’ve used a succession of SetEnvIfNoCase User-Agent lines to identify bad bots, and there is a list of denies of IP address blocks ?
You have to use different .htaccess files. When you put this file inside an internal folder, it will overwrite the parent one.