added security! until now user could upload a file with a name ending in .php and then execute it. File names are now checked to ensure that they contain only letters, numbers and spaces.