Sorry for the double post. But I'd also like to add Attack 4: Malicious files through form uploads

We're discussing it in this thread. Summary: Check the mime type and the file extension. Use white-lists and not black-lists when doing so. And if you're uploading images you can use the getimagesize() to triple check its a valid image. :)