To pile on what Happy-the-monk said, believing that a file extension—or, worse, a substring of a file or a URL—is some kind of guarantee of file content or server side action is a scrub's mistake and the kind of thinking that leads to broken code and potentially serious security problems.