Questions on insecure design

"Why would a web server execute .phtml as PHP?" Apache (a very common web server) uses a configuration file where admins specify which file extensions should be handled by the PHP interpreter. A comm