Shell via upload form?

Question

PHP

The site has a form that uploads files with the .pdf extension to the hosting. Can an unscrupulous person upload a shell using this form?

Answer 1

1. Forbid the execution of files in this folder (disable php execution, etc.)
2. Check not only the extension but also the mime-type
Then you are safe ;)

Answer 2

Prohibit execution of scripts in the directory where *.pdf files are stored.
For Apache, this can be done simply
with .htaccess

php_flag engine 0
AddType "text/html" .php .cgi .pl .fcgi .fpl .phtml .shtml .php2 .php3 .php4 .php5 .asp .jsp