I would have used something to check the mimetype more than checking the extension, as it would allow to use ZIP file without a .zip extension (.ZIP, .jar, ...) ( http://www.php.net/manual/en/function.finfo-file.php )