Comment by cowlevel

Then why did you say

> you can prevent PHP being executed on malicious data by configuring the webserver.