uploading images to the webroot, without strict file type checking is very insecure (many hosts do not allow this becuase you have to make directories world writable).
If you want users to upload files securely, upload them into MySQL.
look on
www.phpbuilder.com on how to upload and store binary data in MySQL.