I think in a PHP file a upload it is a best practice to store files outside of the document root with a randomly generated file name and telling the server to make them non-executable.

If storing them outside the root and preventing them from beeing executed at all is not possible in one particular environment, would it help to alter the files extension to one that certainly will not be treated as a script or something similar?

After the upload the actual extension could be safed in a database and the file will be safed in the file system as "sd7dsf9gd7s8sd9876asd.secureExtension" instead of "dangerousScript.php".

Would this be sufficient protection? What extension would be the best one, then?


**Update:** I was mainly referring to an execution triggered by the attempt to access the file via HTTP.