Security concerns using File Upload process

PHP for Apache SQL Server 2k database User is logged in with username and password. We want to upload a file to web server, then call a VB function to validate it and save it to a table--Parameters: string in (file name), string out (accepted or rejected display for user). All this happens while user is waiting. Not quite sure how to do this. Possibilities that come to mind are a custom Extended Stored Procedure or call a DTS package that calls VB function. Need security concerns from someone who has done this or actual solutions from someone who has done this. (PHP for Apache can't call COM objects, by the way, so no need to go there) (webserver using PHP is not fast enough to do what we want in terms of file validation, so no need to go there either) (we can't change equipment, databases, or software, so no need to go there either) (xp_ExecuteCmdShell freaks the hell out of our head IT guy so no need to go there either, sigh) :) Karen __________________________________ Do you Yahoo!? Yahoo! SiteBuilder - Free, easy-to-use web site design software http://sitebuilder.yahoo.com