title: PHP image upload security approach
body: <p>I develop a php script to replace a current one, that will have a lot of exposure to various markets/countries.
  This script between others offers an photo upload functionality .</p>
  
  <p>After a lot of reading about the issue, I followed the approach described below.
  I would deeply appreciate your comments on its security.</p>
  
  <ol>
  <li>The photo is uploaded in a private 777 folder outside web root.</li>
  <li>A check for white listed extensions is performed (allow only jpgs, gifs, pngs) everything else is deleted.</li>
  <li>Use of getimagesize to check of min-max dimensions and photo validity.</li>
  <li>Check of mimetype and file extension match.</li>
  <li>Resizing of uploaded photo to std dimensions (using imagecopyresampled).</li>
  <li>Saving the created files as jpg.</li>
  <li>Removal of original file.</li>
  <li>Save photos with a new (not random name) ie img51244.jpg.</li>
  <li>Move the new photos to variable subdirectories of a public folder (777 permissions) according to a non predictable algorithm. I.e., <code>img10000.jpg</code> will be stored at <code>photos/a/f/0/img10000.jpg</code> while <code>img10001.jpg</code> will be stored at <code>photos/0/9/3/img10001.jpg</code>. This is done for other reasons (use of subdomains for static content serve or use of a CDN).</li>
  </ol>
  
  <p>The script will run on a linux dedicated server.</p>