PHP File Upload

Handling file uploads is one of the most common but also one of the most dangerous tasks in web development. A proper upload script needs multiple layers of validation to ensure that users only upload safe, allowed items.

1. The Production-Ready Upload Script

Here is a comprehensive example of an upload script that includes several checks.

<?php
    $target_dir = "uploads/";
    $target_file = $target_dir . basename($_FILES["fileToUpload"]["name"]);
    $uploadOk = 1;
    $imageFileType = strtolower(pathinfo($target_file, PATHINFO_EXTENSION));

    // 1. Check if image file is a actual image or fake image
    if(isset($_POST["submit"])) {
        $check = getimagesize($_FILES["fileToUpload"]["tmp_name"]);
        if($check !== false) {
            echo "File is an image - " . $check["mime"] . ".";
            $uploadOk = 1;
        } else {
            echo "File is not an image.";
            $uploadOk = 0;
        }
    }

    // 2. Check if file already exists
    if (file_exists($target_file)) {
        echo "Sorry, file already exists.";
        $uploadOk = 0;
    }

    // 3. Check file size (e.g., limit to 500KB)
    if ($_FILES["fileToUpload"]["size"] > 500000) {
        echo "Sorry, your file is too large.";
        $uploadOk = 0;
    }

    // 4. Allow certain file formats
    if($imageFileType != "jpg" && $imageFileType != "png" && $imageFileType != "jpeg"
    && $imageFileType != "gif" ) {
        echo "Sorry, only JPG, JPEG, PNG & GIF files are allowed.";
        $uploadOk = 0;
    }

    // 5. Check if $uploadOk is set to 0 by an error
    if ($uploadOk == 0) {
        echo "Sorry, your file was not uploaded.";
    } else {
        if (move_uploaded_file($_FILES["fileToUpload"]["tmp_name"], $target_file)) {
            echo "The file ". basename( $_FILES["fileToUpload"]["name"]). " has been uploaded.";
        } else {
            echo "Sorry, there was an error uploading your file.";
        }
    }
?>

Configuration: If your uploads aren't working, check your php.ini file for file_uploads = On, and ensure upload_max_filesize is large enough for your needs.

Essential Validation Steps

MIME Check: Use getimagesize() for icons/images.
Existence Check: Stop overwriting previous files with file_exists().
Size Check: Prevents server storage from becoming full too quickly.
Extension Check: Critical! Never allow .php, .exe, or .js files.

Security Warning: Always rename uploaded files to something random or a unique ID (like uniqid()) to prevent attackers from predicting the file path or executing malicious code.

Pro Tip: Store uploaded file information (like the path and original name) in a database to manage them easily later.

Key Takeaways

File uploads require multiple layers of validation.
PHP populates the $_FILES array with file info.
move_uploaded_file() is the ONLY way to save the file permanently.
Renaming files upon upload is a significant security improvement.
Limit file types strictly (e.g., only images or PDFs).

« Previous Lesson Next Lesson »