unescaped $UPLOAD_URL