You also forget that you want to make sure you are checking the final extension;

"test.gif.php" would technically be a php file, but if you blocked gif's you would still be excluded. I think C#...