>>33
No, you just place everything under a folder which is configured to never execute anything - very basic server config.
Or for extra paranoia you could store each file named by its hash in a non-accessible folder, then redirect requests to the public folder to a script which fetches up the real file.