Udluk at man kan se php filer

Hej alle
Jeg har sådan en upload dims der viser alt det man uploader, Hvor og hvordan gør jeg det, sådan at den ikke viser ( *.Php )


Min kode:

<head>
<style>
A:link {text-decoration: none; font-family:verdana; color: #000000}
A:visited {text-decoration: none; font-family:verdana; color: #000000}
A:active {text-decoration: none; font-family:verdana; color: #9CA6BD}
A:hover {text-decoration: none; color: #6B7A9C}
table {font-family:verdan; font-size: 8pt; color: #000000}
body {font-family:verdana; font-size: 8pt; color: #000000}
</style>
</head>
<?
//-- USER VARIABLE
$user_password = "test";
$admin_password = "adminpass";
//-- That's it! You don't need to touch below.

$site_name = $_SERVER['HTTP_HOST'];
$message = "";
//$message = "cookie_password = ".$_COOKIE['upload_password']. "<br>";
if (!$form_password)
$form_password = $_COOKIE['upload_password'] ;

$upload_dir = "/web/www/frac/users/mmsuploader/Temp/";
$url_dir = "http://www.mmsuploader.frac.dk".$_SERVER['HTTP_HOST'].dirname($_SERVER['PHP_SELF']);
$url_this = "http://www.mmsuploader.frac.dk/updown".$_SERVER['HTTP_HOST'].$_SERVER['PHP_SELF'];
$upload_url = $url_dir."/Temp/";

//$message .= "form_password = $form_password <br>";
//$message .= "upload_files = ".$_COOKIE['upload_files'] ."<br>";

if ( $form_password==$user_password || $form_password==$admin_password)



if ($upload) {
$message .= do_upload($upload_dir, $upload_url);
}

if ($delete) {
if (unlink($upload_dir.$delete)) {
$message .= "Filen $delete er blevet slettet!";
$pos = strpos($_COOKIE['upload_files'], $delete );

//$message .= "delete=$delete<br>";
//$message .= "pos=$pos<br>";
//$message .= "1st=".substr($_COOKIE['Temp'],0,$pos)."<br>";
//$message .= "2nd=".substr($_COOKIE['Temp'],$pos+strlen($delete)+1)."<br>";

$new_cookie = substr($_COOKIE['Temp'],0,$pos)."".
substr($_COOKIE['Temp'],$pos+strlen($delete)+1);
setcookie('Temp', $new_cookie);

}
}
else {

$message .= "";

}


function do_upload($upload_dir, $upload_url) {

if (is_uploaded_file($_FILES['userfile']['tmp_name'])) {

$temp_name = $_FILES['userfile']['tmp_name'];
$file_name = $_FILES['userfile']['name'];
$file_type = $_FILES['userfile']['type'];
$file_size = $_FILES['userfile']['size'];
$result = $_FILES['userfile']['error'];
$max_size = $_REQUEST['MAX_FILE_SIZE'];
$file_url = $upload_url.$file_name;
$file_path = $upload_dir.$file_name;

if ( $file_size > $max_size) {
$message .= "Filen fylder mere end $max_size.";
return $message;
}

$new_file_name=$file_name;
$ver=1;
while ( file_exists($file_path) ) {
$ver++;
$new_file_name = $file_name."[".$ver."]";
$file_path = $upload_dir.$new_file_name;
$file_url = $upload_url.$new_file_name;
}

if ( move_uploaded_file($temp_name, $file_path) ) {
$message .= "

<br>
<br>
Fil Navn : $file_name <br>
Fil Type : $file_type <br>
Fil Størrelse : $file_size byte<br>
";



}

}
else {
if ( $file_name == "") {
$message .= "Ugyldig fil-navn";
return $message;
}
else
$message .= " Possible file upload attack: filename".$real_name;
}

return $message;
}

function display_files($upload_dir,$form_password, $admin_password) {



$upload_url = $url_dir."/Temp/";

if ($handle = opendir($upload_dir));
else
return "ERROR: Cannot Open Directory $upload_dir";

$html = "";

$files_arr = explode( ":", $_COOKIE['upload_files'] );

while (false !== ($file = readdir($handle))) {

$delete_url = $url_this."?delete=".$file;;

if ($file =='..' || $file=='.');
else {
$count = $count+1;
if($count==4) { $html .= "</tr>";
$count = 1; }
if($count==1) { $html .= "<tr>"; }
$html .= "<td align=center><a href='$upload_url$file' target='about_blank'>$file</a></td>";
//$html .= "$file, $files_arr, $form_password, $admin_password <br>";
if ( in_array( $file , $files_arr ) || $form_password == $admin_password )
$html .= "<td><a href='$delete_url'>Delete</a></td>";
else
$html .= "<td> </td>";
}
}

closedir($handle);

return $html;
}



?>

<body>
<table align=center border=0>
<tr><td align=center>
</td></tr>
<tr><td>

<form ENCTYPE="multipart/form-data" method="post" action="upload.php">
<table width=100%>
<tr><td>
<input type="hidden" name="MAX_FILE_SIZE" value="1000000">
<input type="hidden" name="form_password" size="10" value="test"><br>
Upload En Fil:<input type="file" name="userfile" SIZE="25"></td></tr>
<tr><td align=center>
<input type="submit" name="upload" value=" Upload ">
<input type="submit" name="refresh" value=" Opdater "></td></tr>
<tr><td><?=$message?></tr></tr>
</table>
</form></td></tr>
<tr><td>
<table width=100%>
<tr><td align=center><b>Uploadede filer</b></td></tr>
<table width=100%>
<tr><br><td align="center"><?=display_files($upload_dir,$form_password, $admin_password)?></td></tr>
</table></td></tr>
</table>
</body>