filupload sanitized xss issue, hardcoded filenames
model intendation corrected