I used
Now I would like to restrict this by accepting only .pdf and .xls files.
When I click the s
I would filter the files server side, because there are tools, such as Live HTTP Headers on Firefox that would allow to upload any file, including a shell. People could hack your site. Do it server site, to be safe.