Secure file-handling in PHP