I think in a PHP file a upload it is a best practice to store files outside of the document root with a randomly generated file name and telling the server to make them non-executable.

If storing them outside the root and preventing them from beeing executed at all is not possible in one particular environment, would it help to alter the files extension to one that certainly will not be treated as a script or something similar?

After the upload the actual extension could be safed in a database and the file will be safed in the file system as "sd7dsf9gd7s8sd9876asd.secureExtension" instead of "dangerousScript.php".

Would this be sufficient protection? What extension would be the best one, then?

Update: I was mainly referring to an execution triggered by the attempt to access the file via HTTP.

I think in a PHP file upload it is a best practice to store files outside of the document root with a randomly generated file name and telling the server to make them non-executable, so the file will not be executed by an attempt to access the file via HTTP.

If storing them outside the root and preventing them from beeing executed at all is not possible in one particular environment, would it help to alter the files extension to one that certainly will not be treated as a script or something similar?

After the upload the actual extension could be saved in a database and the file will be saved in the file system as sd7dsf9gd7s8sd9876asd.secureExtension instead of dangerousScript.php.

Would this be sufficient protection? What extension would be the best one, then?

I think in a PHP file a upload it is a best practice to store files outside of the document root with a randomly generated file name and telling the server to make them non-executable.

If storing them outside the root and preventing them from beeing executed at all is not possible in one particular environment, would it help to alter the files extension to one that certainly will not be treated as a script or something similar?

After the upload the actual extension could be safed in a database and the file will be safed in the file system as "sd7dsf9gd7s8sd9876asd.secureExtension" instead of "dangerousScript.php".

Would this be sufficient protection? What extension would be the best one, then?

I think in a PHP file a upload it is a best practice to store files outside of the document root with a randomly generated file name and telling the server to make them non-executable.

If storing them outside the root and preventing them from beeing executed at all is not possible in one particular environment, would it help to alter the files extension to one that certainly will not be treated as a script or something similar?

After the upload the actual extension could be safed in a database and the file will be safed in the file system as "sd7dsf9gd7s8sd9876asd.secureExtension" instead of "dangerousScript.php".

Would this be sufficient protection? What extension would be the best one, then?

Update: I was mainly referring to an execution triggered by the attempt to access the file via HTTP.