Then why did you say
> you can prevent PHP being executed on malicious data by configuring the webserver.
You can do this. I don't know how, and I don't think it's a feasible use of my time, to find out how. It's obviously computable on a Turing machine, because they were able to patch PHP.
Configure your webserver to not execute PHP code.