Omeka largely relies on filtering by mime type and extension the files
that can be uploaded.
The main Omeka .htaccess does, however, have a carve-out for .php files
anywhere under Omeka, including the archive: they're always rerouted to
the "main" application as if they didn't exist.
You can also use the Storage settings to upload and serve files from a
different directory, and you can simply configure your server to not run
scripts at that location.
-John