- upload is not hardcoded at the basename of the server
- MAX_FILE_SIZE in upload form is set to the same value as php.ini