question regarding php upload form security

I read here http://blog.insicdesigns.com/2009/01/secure-file-upload-in-php-web-applications/ and question is related with text near

However, if the attacker is able to upload files, even outside the web root, and he knows the name and location of the uploaded file, by including his uploaded file he can run arbitrary code on the server.

The solution for that is to prevent the attacker from knowing the name of the file. This can be done by randomly generating file names and keeping track of them in a database.

I fully do not understand security risk. As i understand

1. attacker uploads malicious file


2. At the moment my php code converts file name to something random and with that random name stores in particular directory. But the malicious user can see that random name, for example with mouse right click Copy location and see https://domain.com/images/2014-05-16/339442/VH4AGExjRlw=/something_random.jpg. So just creating random name does not help?


3. As understand in mysql need to record real name of file and the name that user can see in url?

Can not fully understand. Aim is to prevent situation that user uploads file and then knowing file name, can access the file?