What's the purpose of is_uploaded_file()?
<p>Docs say:</p>

<blockquote>
  <p>Returns TRUE if the file named by filename was uploaded via HTTP POST</p>
</blockquote>

<p>How could <code>$_FILES['blah']['tmp_name']</code> possibly not be the result of a POST upload? PHP created this filename. </p>

<blockquote>
  <p>This is useful to help ensure that a malicious user hasn't tried to
  trick the script into working on files upon which it should not be
  working--for instance, /etc/passwd.</p>
</blockquote>

<p>I understand that I should carefully check the file contents and size. But how could an attacker control whatsoever the <strong>temp filename</strong> of the uploaded file?</p>

<p>Or does <code>is_uploaded_file()</code> do some other checks?</p>

<p>Thanks for shedding some light.</p>
