Uploading a file with HTML and PHP is simple, but accepting arbitrary files from a browser is also a security-sensitive operation. A modern implementation should do more than call move_uploaded_file() ...