Most websites require their images and tmp directories to have Full Write Access. This is in order to store files that are generated by the website itself.

Occasionally there are vulnerabilities in the website’s own code. These vulnerabilities can allow a ‘hacker’ to upload their PHP, or Perl scripts into the affected directories. These files are designed to exploit the website, e.g. to send out massive email spamming campaigns.

TO AVOID THIS:
Create an .htaccess file with the following content and save it in each of the directories that you wish to secure.

<files "*.php"="">
Deny from all
</files>

<files "*.pl"="">
Deny from all
</files>

Allow from all