title: What's the purpose of is_uploaded_file()?
body: <p>Docs say:</p>
  
  <blockquote>
    <p>Returns TRUE if the file named by filename was uploaded via HTTP POST</p>
  </blockquote>
  
  <p>How could <code>$_FILES['blah']['tmp_name']</code> possibly not be the result of a POST upload? PHP created this filename. </p>
  
  <blockquote>
    <p>This is useful to help ensure that a malicious user hasn't tried to
    trick the script into working on files upon which it should not be
    working--for instance, /etc/passwd.</p>
  </blockquote>
  
  <p>I understand that I should carefully check the file contents and size. But how could an attacker control whatsoever the <strong>temp filename</strong> of the uploaded file?</p>
  
  <p>Or does <code>is_uploaded_file()</code> do some other checks?</p>
  
  <p>Thanks for shedding some light.</p>