hmmmmmm covers most of the important points, and as we know... it's not secure to allow uploading files!!!

But uploading files out of the web root is a good idea anyway.