<?php
class file_upload
{
	private $uploaddir;
 
	private $uploadfile;
 
	private $maxfilesize;
 
	/**
	 * The results returned in this message
	 *
	 * @var string
	 */
	public $message;
 
	/**
	 * Upload a file or files to the server
	 *
	 * @param string $upload_dir
	 * @param string $upload_file
	 * @param string $max_file_size
	 */
	public function __construct($upload_dir, $upload_file, $max_file_size = '')
	{
		if (strpos($_SERVER['HTTP_REFERER'], $_SERVER['HTTP_HOST']) === false)
		{
			$this->message = 'Request must originate from domain';
			return false;
		}
 
		$this->uploaddir = $upload_dir;
		$this->uploadfile = $upload_file;
		$this->maxfilesize = $max_file_size;
 
		if ($this->maxfilesize == '')
		{
			$this->maxfilesize = config::max_file_size;
		}
 
		ini_set('max_file_size', $this->maxfilesize);
	}
 
	/**
	 * Upload files
	 *
	 * @param array $white_list
	 * @param string $black_list
	 */
	public function upload($white_list, $black_list = '')
	{
		for ($i = 0; $i < count($_FILES[$this->uploadfile]['name']); $i++)
		{
			$uploadErrors = array(
			    UPLOAD_ERR_INI_SIZE   => 'The uploaded file exceeds the upload_max_filesize directive in php.ini.',
			    UPLOAD_ERR_FORM_SIZE  => 'The uploaded file exceeds the MAX_FILE_SIZE directive that was specified in the HTML form.',
			    UPLOAD_ERR_PARTIAL    => 'The uploaded file was only partially uploaded.',
			    UPLOAD_ERR_NO_FILE    => 'No file was uploaded.',
			    UPLOAD_ERR_NO_TMP_DIR => 'Missing a temporary folder.',
			    UPLOAD_ERR_CANT_WRITE => 'Failed to write file to disk.',
			    UPLOAD_ERR_EXTENSION  => 'File upload stopped by extension.',
			);
 
			if ($_FILES[$this->uploadfile]['error'][$i] != 0)
			{
				$this->message = $uploadErrors[$_FILES[$this->uploadfile]['error'][$i]];
				return false;
			}
 
			if(is_executable($_FILES[$this->uploadfile]['tmp_name'][$i]))
			{
				$this->message = "Uploading executable files Not Allowed";
				return false;
			}
 
			if ($black_list == '')
			{
				$black_list = explode(",", config::file_black_list);
			}
			else
			{
				$black_list = explode(",", $black_list);
			}
 
			$black_listed = false;
			foreach ($black_list as $file)
			{
				if (preg_match("/$file\$/i", $_FILES[$this->uploadfile]['name'][$i]))
				{
					$black_listed = true;
				}
			}
 
			if ($black_listed == true)
			{
				$this->message = 'This file type has been blacklisted';
				return false;
			}
 
			if ($white_list != '')
			{
				$mime = '';
				$white_listed = false;
 
				foreach ($white_list as $file => $mime)
				{
					if (preg_match("/$file\$/i", $_FILES[$this->uploadfile]['name'][$i]) && $mime == $_FILES[$this->uploadfile]['type'][$i])
					{
						$white_listed = true;
						break 1;
					}
				}
 
				if ($white_listed == false)
				{
					$this->message = 'This type of file is not allowed';
					return false;
				}
			}
 
			if ($_FILES[$this->uploadfile]['size'][$i] > $this->maxfilesize)
			{
				$this->message = 'You cannot upload files this size. The maximum file size is ' . $this->maxfilesize;
				return false;
			}
 
			if (!is_uploaded_file($_FILES[$this->uploadfile]['tmp_name'][$i]))
			{
				$this->message = 'The file is not an uploaded file';
				return false;
			}
 
			$uploadfile = realpath($this->uploaddir) . (strpos($this->uploaddir, '\\') !== false ? '\\' : '/') . basename($_FILES[$this->uploadfile]['name'][$i]);
			if (move_uploaded_file($_FILES[$this->uploadfile]['tmp_name'][$i], $uploadfile)) 
			{
				$this->message = 'The file has been successfully uploaded';
			    return true;
			} else {
			    return false;
			}
		}
	}
}
?>

class config
{	
	// Upload
	Const max_file_size	= 9000000;
	Const file_black_list	= '.php,.js,.py';
}

<?php
if ($_SERVER['REQUEST_METHOD'] == 'POST')
{
$uploader = new file_upload(".", 'files');
$whitelist = array('jpg' => 'image/jpeg', 'gif' => 'image/gif');
$uploader->upload($whitelist);
}
?>

<table width="500" border="0" align="center" cellpadding="0" cellspacing="1" bgcolor="#cccccc">
<tr>
<form action="uploader.php" method="POST" enctype="multipart/form-data" name="form1" id="form1">
<td>
<table width="100%" border="0" cellpadding="3" cellspacing="1" bgcolor="#cccccc">
<tr>
<td>
<label for="files">Select File</label>
</td>
<td>
<input name="files[]" type="file" id="files" /></td>
</tr>
<tr>
<td align="center"><input type="submit" name="Submit" value="Upload" /></td>
</tr>
</table>
</td>
</form>
</tr>
</table>