I had my osCommerce hacked a few moments ago and the morons are using it to send emails. I have identified that they placed scripts inside osCommerce images directory.
Is there a way to forbid certain directories like those containing images from running scripts using .htaccess or something?
<Files *.*> order allow,deny deny from all </Files>
on .htaccess is not good because images will not appear on the site.
What can I do beyond applying all osCommerce patches to make it stronger?