Please investigate 'safe' php file upload handling, specifically: the `is_uploaded_file` and `move_uploaded_file` functions.
Also perhaps consider the `mkdir` function, and perhaps 'file_put_contents'. Your reliance on shell functions via `exec` is quite concerning, given what you're doing.
Lastly, I'd suggest either `random_int` or `random_bytes` (combined with e.g. bin2hex, or a hashing function to get an ascii string) instead of uniqid.
I'm not quite sure why there's a check on user agent, to carry out the same logic regardless?
Also perhaps consider the `mkdir` function, and perhaps 'file_put_contents'. Your reliance on shell functions via `exec` is quite concerning, given what you're doing.
Lastly, I'd suggest either `random_int` or `random_bytes` (combined with e.g. bin2hex, or a hashing function to get an ascii string) instead of uniqid.
I'm not quite sure why there's a check on user agent, to carry out the same logic regardless?