What security risks arise from allowing file uploads into a publicly accessible directory, and how do you prevent uploaded files from being executed as scripts?

If uploaded files are stored within a publicly web accessible directory, and an attacker successfully uploads a malicious script disguised as an allowed file type, that directory's web server configuration might allow the malicious file to actually be executed if requested directly, which is why best practice includes storing uploads outside the public web root when possible, configuring the web server to explicitly disable script execution within upload directories, and validating file content thoroughly rather than relying on extension checks alone.

# Nginx configuration to prevent script execution in uploads directory
location /uploads/ {
    location ~ \.php$ { deny all; }
}