You always had to configure your web server properly. "Don't let programs execute arbitrary code" was a solved problem even then.