It seems dangerous to me that a user can upload a .php file through a file upload if no file extension are set, which is the default behavior for the file upload field. Since files are uploaded to an easily guessable path, this looks like a file inclusion vulnerability waiting to happen.
I think you should consider filtering .php files (and .js, too) from being uploaded. Users wanting to submit .php files can package them in an archive such as a zip file.
