> I would actually never let the webserver directly serve uploaded files to the user. Store the files in a directory not served by a webserver, and use a small

> I would actually never let the webserver directly serve uploaded files to the user. Store the files in a directory not served by a webserver, and use a small bit of code to read the file and send it to the user. If you run nginx or lighthttpd you can use X-Sendfile/X-Accel-Redirect for this purpose. Additionally I recommend never having your runnable scripts in the same directory as static content, and also preferrably run the scripts through proxied HTTP or FastCGI. Then you never have to worry about this problem and not either by people being able to download your source code. Apache's default treatment of PHP is an example of bad design making for complex configuration and many possible security holes.