You're using PHP? There are a couple of things to keep in mind. I wrote this article earlier this year which covers file uploads and other topics. Creative Commons so feel free to save a copy, modify, and share as you'd like:
https://keenot.es/read/thwarting-basic-web-application-attacks
"Encrypt your files, store them in a random filename in a specific non-webroot directory, and use a database to keep track of their metadata (type, filename, size). Use a script to deliver them from the filesystem, and use header() calls and rewrite directives to trick browsers into treating them like images. Cache heavily to prevent resource exhaustion."
You don't necessarily need to encrypt them; gzip compressing them or base64 encoding them will prevent execution in case they manage to directly access the file. I do recommend abstracting the filename that people see away from what is actually present on the filesystem. While this might be objected by people as a form of "security through obscurity", but if you store everything as a .txt file, nothing will ever execute through accessing an uploaded file.
One very important thing: Don't rely on the file extension or the user-provided $_FILES['abc']['type'] value. They can be spoofed.