Securing PHP

[new2this2002]

Is there a way in which i can prevent php from processing files other than file with .php extension. The reason I ask is I am able to place php code within an image file (disguise it) and php executes the image file as if it were a php script...is there anyway to prevent this?

i am using PHP 4.4.0 and the Jana Web Server

...any help is greatly appreciated )

 

[vbkris]

what is the correct way to call this file? through another script? this will help me in devicing some sort of method...

Known is handfull, Unknown is worldfull

 

[new2this2002]

just using the php.exe ... so if i do 'php.exe fred.gif' .. if there is php code in the gif (basically a php file renamed as gif), it gets executed. I only became aware of this after someone hacked one of my servers

 

[vbkris]

so u want a file on the server that is NOT accessible at ALL by any browsers???

Known is handfull, Unknown is worldfull