I am dealing with user uploads via a PHP application.

I want to secure the server so no exploits are available to the user, such as uploading a php shell and executing it.

I have set it so all uploads are moved outside the webroot into a separate folder. As an extra security, I have removed all rights except "read" from the IUSR, on the specefic folder.

To take this a step further, I was told to disable script execution on the folder via IIS.

Is this necessary, given my situation and the things I have already done? If yes, how would I achieve this using IIS 8.


  • 1
    Rather than move, it would be better not to write them to a path within your web root in the first place. Also, if the storage folder is not in web root IIS settings to allow script execution will not apply - did they offer any further explanation and where was this advice from? – SilverlightFox Mar 3 '15 at 10:24
  • Do you have to allow all files types, if just pictures, you can take the upload and convert them upon upload which help deter possible code being uploaded as a image and then being run. – Eric G Mar 4 '15 at 3:52
  • Have you already consulted OWASP? owasp.org/index.php/Unrestricted_File_Upload – Eric G Mar 4 '15 at 3:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.