Let’s say I need to allow my clients to upload image/graphic design-related files for my review and/or action. Let’s also say that due to the nature of my clients the upload should be allowed without supplying credentials, but not anonymously. My clients expect prompt attention to files that they upload, therefore I would like to be notified immediately, via e-mail, when files are uploaded as well as some details about the uploaded files as well as who they are reportedly from.
If I create this “secure”, anonymous file upload form in PHP, what security issues need to be addressed to have relative peace-of-mind before putting this functionality in place?

1. Ensure that only the expected types are files (.jpg, .gif, .psd, .pdf to name a few) allowed.

How can this be achieved? Checking file extensions? Checking mime-encoding? imagecreatefromjpeg() (to validate jpgs)

2. Prevent malicious code from being uploaded and executed

Set default permissions to deny execute privileges on files. Deny extensions commonly associated with malicious code (exe, php, asp, js, no extension?, …?)

3. Prevent server disk space from completely completed exhausted in a short period of time (less than 24 hours)

“Captcha” prompt? Random question? IP logging? Minimum free space checks?

x. ?? What else? I would appreciate your input.