尽管在 .htaccess 中使用了“ForceType image/jpeg”，但 PHP 文件仍在执行

Question

To prevent any PHP files from executing if uploaded to my image directory, I have created a .htaccess file solely containing ForceType image/jpeg , placed within this directory.

While this successfully causes evil.txt to be interpreted as an image file when opened by a browser, evil.php executes just fine (it echoes text to the browser). I have even tried directly targeting it:

<FilesMatch "evil.php">
    ForceType image/jpeg
</FilesMatch>

But this doesn't work either.

Answer 1

Those are two completely unrelated things. ForceType is for the client, not the web server. The thing that's interpreting the PHP is your apache httpd web server. The way it knows to interpret a file as PHP or not is based on your FilesMatch directive containing a SetHandler which lets httpd know to let these files go to mod_php . These two things are completely unrelated to each other.

In other words, you're probably thinking (very cleverly) that you're doing something that's going to make your apache httpd configuration more safe. I assure you that you aren't. Files that don't end in .php won't go through php in that configuration scenario. And since you control what files are named in your webroot, this should not be a concern. Simply don't allow the user to control the naming of files on your server. It's that simple