I'm not sure if this question is within the scope of security.stackexchange or it would be more suitable on stackoverflow. Let me know if needed.
My question is:
Is there anything risky about this process if we assumed a malicious user? Is there anything they could upload and send to the php script that would compromise the server? My instinct is to say no, since the PHP script is extremely simple and only performs string calculations (not to mention that all punctuation is removed from the input file), but since I'm really inexperienced with PHP, I thought to ask and make sure before I share it with anyone.
If any further information is required, let me know.