It's great that you had a need and tackled it by writing a script. However, after a brief look at your source, you have a directory traversal vulnerability - there may be other issues too. You are taking a query parameter "d" and appending that to photo_dir which is then used in a variety of places. https://www.owasp.org/index.php/Path_Traversal describes what a directory traversal is. Take a look at https://www.owasp.org/index.php/PHP_Security_Cheat_Sheet or http://www.phptherightway.com/ for some primers.