with this code inside my
.htaccess nobody can execute scripts in this folder (i gues...).
The only way to know whether it works "on your server" is to test it. If it works on your server to block direct script access (from the client) for the type of scripts that you are trying to block then "it works".
With the many different servers, there isn't necessarily a single/best way to do this. The directives you posted are arguably "generic" - designed to work across several different servers. You don't need all of them.
SetHandler default-handler and
RemoveHandler all do the same sort of thing so I can't imagine they are all required. It's likely that different server configs require different settings.
php_flag engine off will only work when PHP is installed as an Apache module. It won't work if PHP is running as CGI/FastCGI - in fact, you may even get a 500 internal server error!
The only change I would perhaps make is to change
Options -ExecCGI to the more encompassing
Options None. This also disables
Includes (server-sides includes),
Indexes (directory listings) etc. But it's possible these are already disabled in your server config.
<Files> wrapper may be required on some servers if using the
RemoveHandler method to block running scripts. Whilst
<Files *> simply targets every file, as if there is no wrapper at all, it changes the order of execution so the directives run later - to ensure they override any earlier
However, to clarify... this doesn't necessarily "disable the execution of scripts in a folder". It prevents the client (user-agent / browser) from making direct (HTTP) requests to scripts in a directory. Any script can still be executed in this directory if it is "called" (eg. included) from another script elsewhere on your system.
For example, say you have protected the
/public_html/user directory tree with a
.htaccess file at
/public_html/user/.htaccess and you have another PHP script elsewhere on your filesystem, say at
bar.php has a statement like:
myavatar.jpg will still be "executed", despite
/user/.htaccess disabling script access to this directory. (In this contrived example,
myavatar.jpg is not a JPG image, but a PHP script containing
<?php blocks - the file extension is irrelevant). The
.htaccess file is only processed for direct HTTP access, not filesystem access from other scripts.
See also this related question: