I built a form that lets the user to upload files to a specific directory (apache2, php). I already limited file type and did some other security things. But I would anyway also like to deny the execution of those files to all. They're meant to be only downloaded. I've got the following code for htaccess, but it's a fake one, not sure of the syntax, nor if it's the right way of doing it:
<Location "/example/mydir/"> <Files .> ForceType application/octet-stream Header set Content-Disposition attachment </Files> </Location>
Could you please help me correct that code or change it to best practices?