I run a free web hosting business, and have run into severe hacking problems, with users using PHP. Now I was wondering (this hosting business uses a shared server) if there is anyway to completely disable PHP for ALL subdirectories, but allows php in the main directory (www.whatever.com/index.php). This way the php for the upload, sign-up, log-in, etc. work, but the users cannot use PHP on their pages. Is this possible in a shared environment (whether in php or not), and if so how?

Thanks! :)

perhaps you can do this in your .htaccess file, much like you would prevent hotlinking of your images, perhaps something along the lines of...


RewriteEngine On
RewriteRule \.(php|php3)$ /noscripts.html [L]



you'll probably need some sort of RewriteCond line in there to allow your main site.

Thanks! :)

Is there any place I should add these lines in, or would it work anywhere?

Put this in the httpd.conf (or apache2.conf),
and it will redirect requests for php in subdirectory.
(You don't need RewriteCond with this code)

RewriteEngine On
RewriteRule [^/]+/[^/]+\.php[345]?$ /noscripts.html [L]

Thanks! :)

You could also set a PHP header file that checks if its a subdomain and then if it is kill the script.

Have a look at engine (http://www.php.net/manual/en/ref.apache.php#ini.engine).

Just add this to your .htaccess
php_flag engine 0

Thanks! :)