Unless your server has some strange settings, that shouldn’t pose a problem. The server won’t execute a file with a .gif extension, even if it has .php in there somewhere. It’ll attempt to load it like a picture. Since the file format won’t be valid, it won’t actually display anything (except maybe a broken image icon).

If you wanted to stop an upload script from the allowing the file (since it would be dangerous if the infiltrator could rename the script somehow once it had been uploaded), you’d need to edit the upload script’s validation code. It probably checks for the last three characters in the filename and assumes that is the file extension.

Instead, you could change this to a regex check for anything that includes “.php.” You could also explode the filename on “.” and check each part to see if it is equal to “php.” In the example you provided, the explosion would result in “xxxxx,” “php,” and “gif.” It’d be easy for your script to tell that there’s a .php extension in there somewhere.

i thought about the disallowing of uploading php-files, but i have decided to just not allow to php files to be executed in the upload directory and any other directories php files should not run. hope this helps