We have not discussed security much in the previous chapters. This is because it is assumed that you are a good programmer and know what you're doing. There are some points about file management that need to be re-iterated, though—anything that affects files on the server is a weak point and will be targeted by crackers.
If possible, never allow the user to decide the name of the file on the server. For example, if the uploaded file is meant to be a profile photo, rename the file based on the user's ID (or some other criteria).
To demonstrate why this is important, try this example—create a text file with the following contents, name it test.php.jpg, and view it in your browser:
<?php echo 'hello world'; ?>
When viewed in the browser, you will see that the server executes the file as PHP, instead of attempting to display it as an image, or even sending it as plain text to the browser:
What is alarming about this scenario is that most developers check only the last extension...