File uploads are risky because they accept data from outside your site. Treat every upload as untrusted until it has passed validation and is stored safely.
Check the file size, extension, and MIME type. These checks are not perfect by themselves, but together they reduce obvious abuse and help catch mistakes early.
Rename uploaded files before saving them. User-provided filenames can contain confusing characters, duplicate names, or information you do not want to expose.
Most importantly, block script execution inside upload folders. A folder meant for images and documents should not run PHP, Perl, Python, CGI, or shell files.
Store uploads outside the web root when possible, then serve them through controlled download logic. If they must be public, keep the folder locked down and monitor it.