Allow only PHP files to be run and prevent shell command injection