title: How can I protect a PHP image upload script from exploits?
body: <p>I've created (using <a href="http://www.dagondesign.com/articles/secure-php-form-mailer-script/">a script</a> and some help from Stack and some help from friends; I know very little about PHP) a simple page for a local non-profit publication where people can upload photos. </p>
  
  <p>I'm not great with security (from a basis of ignorance, not deliberate negligence) but I've taken the following steps to protect this page: </p>
  
  <p>• the PHP script is set to only accept .jpg, .png and .tif files for upload;<br>
  • the subfolder that it saves the form content to has permissions set at 700, and the subfolder it saves uploaded photos to has permissions set at 700;<br>
  • according to documentation, my host has the following configuration to ensure that only .php files run as .php: </p>
  
  <pre><code>&lt;FilesMatch \.php$&gt;
      SetHandler php52-fcgi
  &lt;/FilesMatch&gt;
  </code></pre>
  
  <p>• I’ve put an .htaccess file in the relevant (main and saved content) folders: </p>
  
  <pre><code>RemoveHandler .php
  RemoveHandler .inc
  RemoveHandler .pl
  RemoveHandler .cgi
  RemoveHandler .py
  RemoveHandler .fcgi
  </code></pre>
  
  <p>Overnight, however, somebody found this test page and submitted what seems to be a perfectly benign test message and small .jpg. This is a private test page with a non-intuitive URL that only I and about three other people know about; none of the others sent this test. </p>
  
  <p>This obviously has me worried that there's something hinky going on, and I'm worried that I don't know enough about security to make sure this page is safe. </p>
  
  <p>Is there something obvious that I'm missing? </p>