I think in a PHP file upload it is a best practice to store files outside of the document root with a randomly generated file name and telling the server to make them non-executable, so the file will not be executed by an attempt to access the file via HTTP.
If storing them outside the root and preventing them from beeing executed at all is not possible in one particular environment, would it help to alter the files extension to one that certainly will not be treated as a script or something similar?
After the upload the actual extension could be saved in a database and the file will be saved in the file system as
sd7dsf9gd7s8sd9876asd.secureExtension instead of
Would this be sufficient protection? What extension would be the best one, then?