[PHP] upload di file in cartella e sua sicurezza

function GestisciUpload($target_dir = "models/")
{
    $allowed_type = array(
        'application/acad',
        'application/dxf',
        'application/iges',
        'application/octet-stream',
        'application/sla',
        'application/vnd.ms-pki.stl',
        'application/x-navistyle',
        'image/gif',
        'image/jpeg',
        'image/pjpeg',
        'image/png',
        'image/vnd.dwg',
        'image/x-dwg',
        'model/iges',
        'x-world/x-3dmf',
    );
    $UploadErrors = array(
        'There is no error, the file uploaded with success',
        'The uploaded file exceeds the upload_max_filesize directive in php.ini',
        'The uploaded file exceeds the MAX_FILE_SIZE directive that was specified in the HTML form',
        'The uploaded file was only partially uploaded',
        'No file was uploaded',
        'Missing a temporary folder',
        'Failed to write file to disk',
        'A PHP extension stopped the file upload. PHP does not provide a way to ascertain which extension caused the file upload to stop; examining the list of loaded extensions with phpinfo() may help',
    );

    $err = $_FILES['fileToUpload']['error'];
    if ($err > 0 )
    {
        echo "ERRORE : ".( $err < 8 ? $UploadErrors[$err] : $err )."<br /><br />";
        return 0;
    }

    // controllo se esiste la cartella di destinazione
    if ( !is_dir($target_dir) )
    {
        echo "ERRORE : La cartella di destinazione non esiste<br /><br />";
        return 0;
    }

    $file_name = strtolower(basename($_FILES["fileToUpload"]["name"]));     // nome originale del file
    $file_type = strtolower($_FILES['fileToUpload']['type']);               // tipo
    $file_size = $_FILES['fileToUpload']['size'] / 1024;                    // dimensione in kB
    $file_temp = strtolower($_FILES['fileToUpload']['tmp_name']);           // path e nome assegnato dall'upload

    $file_path = $target_dir;
    $file      = $file_path.$file_name;

    // visualizzazioni da eliminare (commentare) in produzione
    echo "Upload : "        .$file_name    ."<br />";
    echo "Type : "        .$file_type    ."<br />";
    echo "Size (kB) : "        .$file_size    ."<br />";
    echo "Stored in : "        .$file_temp    ."<br />";
    echo "target folder : "    .$file_path    ."<br />";
    echo "target file : "    .$file        ."<br />";

    // $mime_type = ( new finfo(FILEINFO_MIME_TYPE) )->buffer( file_get_contents($file_temp) ); // extension=php_fileinfo.dll in php.ini
    // echo "MIME TYPE : "        .$mime_type    ."<br />";

    // controllo se è accettabile
    if ( !in_array($file_type, $allowed_type) )
    {
        echo "ERRORE : Il file non &egrave; del tipo corretto.<br /><br />";
        return 0;
    }

    // controllo la dimensione
    if ($file_size == 0)
    {
        echo "ERRORE : Il file &egrave; vuoto.<br /><br />";
        return 0;
    }
    if ($file_size > 5000)
    {
        echo "ERRORE : Il file ha una dimensione troppo grande. Carica un file che non superi i 5 Mb.<br /><br />";
        return 0;
    }

    // controllo se esiste lo stesso nome
    if ( file_exists($file) )
    {
        echo "ERRORE : Il nome scelto per il file esiste gi&agrave;. Rinomina il tuo file!<br /><br />";
        return 0;
    }

    // sposto il file nella destinazione (copia e cancellazione, move non funziona)
    // $err = copy($file_temp, $file);
    // unlink($file_temp);

    $err = move_uploaded_file($_FILES["fileToUpload"]["tmp_name"], $file);
    if ( !$err ) {
        echo "ERRORE : Lo spostamento del file nella destinazione non &egrave; riuscito"."<br /><br />";
        return 0;
    }

    // controllo se il file é arrivato a destinazione
    if (!file_exists($file))
    {
        echo "ERRORE : Il file non &egrave; arrivato a destinazione<br /><br />";
        return 0;
    }

    // non ho altro da fare
    echo "Il file -- ".$file_name." -- &egrave; stato caricato correttamente.";
    return 1;
}

    // $mime_type = ( new finfo(FILEINFO_MIME_TYPE) )->buffer( file_get_contents($file_temp) ); // extension=php_fileinfo.dll in php.ini
    // echo "MIME TYPE : "  .$mime_type."<br />";

    // $mime_type = ( new finfo(FILEINFO_MIME_TYPE) )->buffer( file_get_contents($file_temp) ); // extension=php_fileinfo.dll in php.ini
    // echo "MIME TYPE : "  .$mime_type."<br />";

    $mime_type = mime_content_type($file_temp);
    echo "MIME TYPE : ".$mime_type."<br />";
    $file_type = $mime_type;

    // $mime_type = ( new finfo(FILEINFO_MIME_TYPE) )->buffer( file_get_contents($file_temp) ); // extension=php_fileinfo.dll in php.ini
    // echo "MIME TYPE : "  .$mime_type."<br />";

    $mime_type = mime_content_type($file_temp);
    echo "MIME TYPE : ".$mime_type."<br />";
    $file_type = $mime_type;

'application/octet-stream',