$target_path = "extrafiles/";
$target_path = $target_path .
$SESSION["orderid"]."".basename($_FILES['extraattached']['name'][$x]);
Be careful about that "." bugger. Concatenation in PHP is difficult to notice in a font other than Courier or other system fonts. The developer of that script is paying close attention to the actual width of his script, which is good, because it allows for comments to be placed to the right of the code, instead of interspersed in the code itself.