I noticed that it\'s possible to run a file via PHP even if its extension wasn\'t .php, for example file test.xyz.php.whatever.zyx can be still run wit
.php
test.xyz.php.whatever.zyx
The following .htaccess-code could work and deny access to files containing "php":
.htaccess
php
Deny from all