Yes, we should allow that and disable php execution :)

In the meantime you can attach it as text, script.txt instead of .php.

You are wrong.  Changing the extension to .txt has no effect.  You get the following:

Error: uploaded patch file must be text file (save as e.g. "patch.txt" or "package.diff") (detected "text/x-php")
Could not attach patch "foo.txt" to Bug #12345

Try it for yourself.

I'm betting you're using the "file" command, which does in fact say "text/x-php", no matter what the extension.

Instead of checking for mime type of "text/plain" or "text/html" or whatever, why not just check if the first five chars are "text/", and that the extension is an allowable one like ".diff" or ".txt" or whatever?

In my opinion, the only bug is the description of the "Description":

| Put short code samples in the "Test script" section below and
| upload patches and/or long code samples below.

Removing the "and/or long code samples" would make it consistent
with the other descriptions, namely the one for "Patch file":

| A patch file created using git diff (unified diff format)

and "Test script":

| A short test script you wrote that demonstrates the bug. Please
| do not post more than 20 lines of code. If the code is longer
| than 20 lines, provide a URL to the source code that will
| reproduce the bug.

I don't see an issue with an external link.

The description has been changed to make it more clear that only
patches in unified diff format are accepted for upload. Long test
scripts are better avoided, anyway, and if there is the need for
them, they can be made available somewhere else (e.g.
https://gist.github.com/) and linked to in the ticket.