What, JS, PHP, and HTML all in the same procedural script? I get that the idea is that it's single-file, but it doesn't make for pretty (or terribly maintainable) code.
It's a neat little script, but I see at least one severe exploit in there ($filename - leave the rest to you).
It's a neat little script, but I see at least one severe exploit in there ($filename - leave the rest to you).