I can still upload php files or any files. You have to strict any upload to prevent users to upload any malicious code to our application