When I upload a file, could I search the file's byte stream for the byte value of <script, <embed or <object and reject if found, to further protect from malware and attacks? Is this the way I would go about it?

I have the size check and ext -> mime check.

Thanks,

Justin