Using .htaccess to block tor servers

The lower .htaccess rules will override parent directories' .htaccess files. Apache climbs up the directory tree from root and builds the configuration tree from the .htaccess found in each directory, and later changes to the configuration override prior settings.

/var/www/.htaccess

/var/www/html/images/.htaccess overrides

/var/www/html/images/subdir/.htaccess overrides

I do not think that .htaccess files can restrict lower .htaccess files, but you might think about disabling .htaccess files (AllowOverride None) and doing your configuration at the server level, or create a dummy .htaccess file in the lower directory and restrict it's modification with file permissions.

What are some general security precautions that others take or best practice with handling the allowing of file uploads? How can we stop these scripts from being abused?

Host your upload folder separate from any of the application scripts/binaries. Setup Apache so that it will not execute any cgi/php/etc code from the upload directory. Ideally host the upload data in a directory outside of the webroot.

Since you are hosting many users, use a PHP server/module so each user's code operates under their own userid.

Beyond that you cannot really protect a person able to publish code to your server from themselves. If they upload insecure code, then they will see the consequences. It is simply impossible to have 100% protection.