note 106294 deleted from reserved.variables.files by danbrown

Note Submitter: doktor dot jones at gNOSPAmail dot com ---- the ['type'] variable *IS* provided by the client, and should accordingly be treated as potentially harmful (so don't go inserting it directly into an SQL DB, or assume that something with the "image/gif" type really is a GIF). As stated at http://us.php.net/manual/en/features.file-upload.post-method.php : "You could use the $_FILES['userfile']['type'] variable to throw away any files that didn't match a certain type criteria, but use this only as first of a series of checks, because this value is completely under the control of the client and not checked on the PHP side."