You should also check the extention, because someone could upload a valid image with some random php code at the end and your script will save it as .php so it will run. Don't have the time to fix this now but maybe later...