This article is an example of how not to handle file uploads. The main problem being that the script should not be messing around with files in a global temp directory - after running what sanity checking can be done based on the FILES array (not much since most of that data is under remote control), it should be using move_uploaded_file() to get the data into a local file first and then perform all needed sanity checking on it. This is especially relevant for shared hosts - if setup properly the global upload directory should be off limits!

This is much better covered in the official PHP docs:

http://ca2.php.net/manual/en/features.file-upload.php