title: Stop people uploading malicious PHP files via forms
body: <p>I have an upload form created in php on my website where people are able to upload a zip file. The zip file is then extracted and all file locations are added to a database. The upload form is for people to upload pictures only, obviously, with the files being inside the zip folder I cant check what files are being uploaded until the file has been extracted. I need a piece of code which will delete all the files which aren't image formats (.png, .jpeg, etc). I'm really worried about people being able to upload malicious php files, big security risk! I also need to be aware of people changing the extensions of php files trying to get around this security feature.</p>
  
  <p>This is the original script I used <a href="http://net.tutsplus.com/videos/screencasts/how-to-open-zip-files-with-php/" rel="noreferrer">http://net.tutsplus.com/videos/screencasts/how-to-open-zip-files-with-php/</a></p>
  
  <p>This is the code which actually extracts the .zip file:</p>
  
  <pre><code>function openZip($file_to_open) {
      global $target;
  
      $zip = new ZipArchive();
      $x = $zip-&gt;open($file_to_open);
      if($x === true) {
          $zip-&gt;extractTo($target);
          $zip-&gt;close();
  
          unlink($file_to_open);
      } else {
          die("There was a problem. Please try again!");
      }
  }
  </code></pre>
  
  <p>Thanks, Ben.</p>