Note: this script places the file outside of the webroot, inaccessible to the webserver. Note: there is a 16MB limit on uploaded files.