Formulaire d'upload pas sécurisé

if(!empty($_FILES))
{
	$avatar = $_FILES['avatar'];
	$avatar_name = $avatar['name'];
	$ext = strtolower(substr(strrchr($avatar_name,'.'),1));
	$ext_aut = array('jpg','jpeg','png');
	
	function check_extension($ext,$ext_aut)
	{
		if(in_array($ext,$ext_aut))
		{
			return true;
		}
	}
	
	$valid = (!check_extension($ext,$ext_aut)) ? false : true;
	$erreur = (!check_extension($ext,$ext_aut)) ? 'Veuillez charger une image' : '';
	
	if($valid)
	{
		$max_size = 2000000;
		if($avatar['size']>$max_size)
		{
			$valid = false;
			$erreur = 'Fichier trop gros';
		}
	}
	
	if($valid)
	{
		if($avatar['error']>0)
		{
			$valid = false;
			$erreur = 'Erreur lors du transfert';
		}
	}
	
	if($valid)
	{
		$path_to_image = 'image/image';
		$path_to_min = 'image/miniature';
		
		$filename =  rand (10000,50000);
	
		
		$source = $avatar['tmp_name'];
		$target = $path_to_image . $filename. '.'. $ext;
		$mintarget = $path_to_min . $filename. '.'. $ext;
		
		
		move_uploaded_file($source,$target);
		
		if($ext == 'jpg' || $ext == 'jpeg') {$im = imagecreatefromjpeg($path_to_image.$filename.'.'.$ext);}
		if($ext == 'png') {$im = imagecreatefrompng($path_to_image.$filename.'.'.$ext);}
		
		
		$ox = imagesx($im);
		$oy = imagesy($im);
		
		$nx = 300;
		$ny = floor($oy *($nx/$ox));
		
		$nm = imagecreatetruecolor($nx,$ny);
		
		imagecopyresized($nm, $im, 0,0,0,0, $nx,$ny,$ox,$oy);
		
		imagejpeg($nm, $path_to_min.$filename.'.'.$ext);
		
		$nom_image = $target.''   ;
		$min =  $mintarget.'' ;
		

		$data= array(

		'image'=>$nom_image,
	    'min'=>$min
		
		);

		$nb= $DB->insert("INSERT INTO images (image,min) VALUES (:image,:min)",$data);
	
	   header('Location:upload.php');
                exit;
	
	
	}
}