I currently have a webserver running Windows Server 2012 which is running IIS as its webserver and using PHP.

Lets assume the a user is able to upload a trojan onto my server, either through a vulnerable hosted site or perhaps some other exploit.

If the user is able to find the site directory the file was uploaded to, he can navigate to it, thus executing the virus.

Recently I talked about this possibility to my colleague and he stated that his server is configured in a way that would only allow the execution of php scripts.

How does one configure his/her server to only allow php scripts to be run or at the least disallow certain file types from being executed by the attacker.