added htmlspecialchar() to protect XSS. File still not removing items  or uploading correctly.