Can PHP files with an extension of .php.xx be executed as PHP?
Say you have a file myfile.php which executes some PHP code. Could this file somehow (any possible way) be executed if it were named myfile.php.xx, where xx are any characters? What about myfile.phpxx? What about other types of executable files in the same situation (.pl, .exe, .dll, etc)?
I'm working on a firewall, using regexes to check file names for these types of files. Is it enough to just check the end of the file for .php, .exe, etc., or should it check what comes after it, too?
It's completely up to the web server to decide how it wants to handle a given URL. If it wants to treat a URL with a 20-digit number accessed at 2:35 in the afternoon on the third Thursday in the month as a PHP script then that is its prerogative. Attempting to guess what the web server will do strictly by the URL requested is not possible.