Why move_uploaded_file() Doesn't Validate Anything You Think It Does

$_FILES[‘type’] is the HTTP header the attacker sent. finfo can be fooled by polyglots. Why your PHP upload handler is broken.