First of all, sorry if the question is unclear due to my poor knowledge.
I'm interested to know how apache calls the appropriate engine/invoker to serve a request. Suppose, user requests a http://somesite.com/someurl.php
- now how apache determines that it needs to launch the PHP interpreter? Does apache determines so based on the file extention/MIME type or anything else?
What I know is: I can configure apache to invoke certain interpreters based on file's extension, by something like:
AddHandler cgi-script .cgi .py
# Tells apache to treat .cgi & .py files to treat as cgi scripts
Why I'm concerned about it? Recently, I came to know from my question ( PHP file upload: mime or extension based verification? ) that if some user uploads a file with wrong MIME type (i.e image/jpeg
) but with an extention .php
the file can get executed (assuming it has got execution permission) and malicious php code included with the EXIF meta-data can do harmful things.