Update upload.php

the file is moved only if we are sure that it is an image