Help securing my site

[toin7]

Ok, so I recently implemented an image upload script for people to have an avatar. It's very simplistic and probably full of holes. Could someone show me how to secure it? A proof of concept exploit of the code would be nice too as I like to know what the security is protecting me against. I don't like coding things that I have no idea how they work.

if ($Submit) {

$imageinfo = getimagesize($_FILES['imagefile']['tmp_name']);
$imgsz = 250;
if ($_FILES['imagefile']['size']/1024 > $imgsz) {

echo "Error: The maximum filesize is 250kb. Your image was ".round($_FILES['imagefile']['size']/1024,2)."kb.";

}elseif ($imageinfo[2] != 1 && $imageinfo[2] != 2 && $imageinfo[2] != 3) {

echo "Error: The filetype must be JPG, GIF or PNG.";

}else{
...
}

[Iturea]

I don't know php at all but as long as $imageinfo[2] != 1 is checking the extention your fine. If its checking the mime type then its no good.