I recently built a Downloads Manager that will debut though before I do so I want to know what file extensions I should explicitly disallow from being accepted?

Running LAMP/WAMP the most obvious I've come up with since the five minutes this issue came to mind:

  • *.htaccess
  • *.php

The idea is to allow clients who use the software to build websites to host their own files directly so we want to allow them the flexibility while at the same time we're not a dedicated file hosting service. Here is a good article that I'm going to read more in-depth especially about the more obscure file extensions. I think the best bet there is to review allow extension association, disable everything except for what we use and still disallow those extensions from being uploaded.


Let people store anything they want, rename the file to something random (SHA1 of random long number is enough), move them off the server root, and record the new name and original name on a database, taking care of sanitizing the filename.

List files using the original names on the filename (again take care with sanitization), and use PHP fpassthru or Apache mod_xsendfile to send the file, as both are able to read the file stored outside server root.

This way the client will not have direct access to the uploaded files, even files with invalid names will be safely stored.

  • I'm following this for the most part. Is there a more detailed tutorial you could link or expand on the details in your post please? – John Sep 26 '19 at 14:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.