Gratefully,
Rad

Not always. There is a class of vulnerabilities known as Arbitrary File Upload. What an attacker will do is, put in the source code for a PHP shell(a web application used to manipulate a server) into a text document and then name it "name.php.jpg". what this is doing is disguising the shell as a JPEG image. This file will be uploaded unless your web application sanitizes the inputted file. So make sure that your web application does sanitize the file by making sure that the data that the file holds is of correct extension.