Uploading files is a common feature in PHP applications, whether it’s user profile pictures, documents, or media files. However, poor file upload handling can lead to security risks, such as malware uploads, data leaks, and server overload.
🎯 In this guide, you’ll learn:
✅ How file uploads work in PHP
✅ Handling file uploads securely
✅ Validating file types and sizes
✅ Preventing common security vulnerabilities
✅ Building a fully functional file upload system
By the end of this tutorial, you’ll have a secure and efficient file upload system ready for real-world use! 🚀
1️⃣ How File Uploads Work in PHP
PHP handles file uploads using the $_FILES superglobal array, which stores uploaded file information. When a user uploads a file through an HTML form, PHP:
1️⃣ Saves the file temporarily in a temp folder.
2️⃣ Stores file metadata in $_FILES, including:
| Key | Description |
|---|---|
$_FILES["file"]["name"] |
Original filename |
$_FILES["file"]["type"] |
MIME type (e.g., image/png) |
$_FILES["file"]["size"] |
File size in bytes |
$_FILES["file"]["tmp_name"] |
Temporary file location |
$_FILES["file"]["error"] |
Error code (if any) |
3️⃣ Moves the file to a permanent location using move_uploaded_file().
2️⃣ Creating a Basic File Upload Form
First, create an HTML form to upload files.
<form action="upload.php" method="post" enctype="multipart/form-data">
<input type="file" name="file" required>
<button type="submit">Upload</button>
</form>
🔥 What’s happening?
✅ The enctype="multipart/form-data" is required for file uploads.
✅ The <input type="file"> allows users to select a file.
3️⃣ Processing the File Upload (upload.php)
Now, let’s write a basic PHP script to handle file uploads.
<?php
if ($_SERVER["REQUEST_METHOD"] == "POST" && isset($_FILES["file"])) {
$upload_dir = "uploads/";
$file_name = basename($_FILES["file"]["name"]);
$target_file = $upload_dir . $file_name;
if (move_uploaded_file($_FILES["file"]["tmp_name"], $target_file)) {
echo "File uploaded successfully: " . $file_name;
} else {
echo "Error uploading file.";
}
} else {
echo "No file uploaded.";
}
?>
🔥 How does it work?
✅ Checks if the form was submitted ($_SERVER["REQUEST_METHOD"] == "POST")
✅ Stores uploaded file in the uploads/ directory
✅ Uses move_uploaded_file() to save the file permanently
But wait! This code has security risks ❌. Let’s fix them.
4️⃣ Securing File Uploads in PHP
1️⃣ Validate File Type
Users might upload malicious files (e.g., .exe, .php). Let’s allow only safe file types.
$allowed_types = ["jpg", "jpeg", "png", "gif", "pdf"];
$file_ext = strtolower(pathinfo($file_name, PATHINFO_EXTENSION));
if (!in_array($file_ext, $allowed_types)) {
die("Invalid file type. Only JPG, PNG, GIF, and PDF allowed.");
}
🔥 Why?
✅ Blocks malicious file types
✅ Prevents PHP file execution
2️⃣ Validate File Size
To prevent large files from crashing the server, set a max file size.
$max_size = 2 * 1024 * 1024; // 2MB
if ($_FILES["file"]["size"] > $max_size) {
die("File size too large. Maximum 2MB allowed.");
}
🔥 Why?
✅ Protects server resources
✅ Avoids denial-of-service (DoS) attacks
3️⃣ Rename Uploaded Files
To prevent overwriting existing files, generate a unique filename.
$new_file_name = uniqid() . "." . $file_ext;
$target_file = $upload_dir . $new_file_name;
🔥 Why?
✅ Avoids filename collisions
✅ Prevents overwriting user files
4️⃣ Store Files Outside Public Directory
Never store uploaded files in a public folder (public_html, www).
🚀 Best Practice: Store files outside the public directory and serve them via a script.
1️⃣ Move uploaded files to a private folder (storage/uploads/)
2️⃣ Use a PHP script to serve files securely
Example: download.php
<?php
$file = "storage/uploads/" . $_GET["file"];
if (file_exists($file)) {
header("Content-Type: application/octet-stream");
header("Content-Disposition: attachment; filename=" . basename($file));
readfile($file);
} else {
die("File not found.");
}
?>
🔥 Why?
✅ Prevents direct access to files
✅ Improves security
5️⃣ Final Secure File Upload Script
Now, let’s put everything together into a fully secure file upload system.
<?php
session_start();
if ($_SERVER["REQUEST_METHOD"] == "POST" && isset($_FILES["file"])) {
$upload_dir = "storage/uploads/";
$allowed_types = ["jpg", "jpeg", "png", "gif", "pdf"];
$max_size = 2 * 1024 * 1024; // 2MB
$file_name = basename($_FILES["file"]["name"]);
$file_ext = strtolower(pathinfo($file_name, PATHINFO_EXTENSION));
// Validate file type
if (!in_array($file_ext, $allowed_types)) {
die("Invalid file type. Only JPG, PNG, GIF, and PDF allowed.");
}
// Validate file size
if ($_FILES["file"]["size"] > $max_size) {
die("File size too large. Maximum 2MB allowed.");
}
// Generate unique filename
$new_file_name = uniqid() . "." . $file_ext;
$target_file = $upload_dir . $new_file_name;
if (move_uploaded_file($_FILES["file"]["tmp_name"], $target_file)) {
echo "File uploaded successfully: " . $new_file_name;
} else {
echo "Error uploading file.";
}
} else {
echo "No file uploaded.";
}
?>
🔥 Why is this secure?
✅ Validates file type & size
✅ Renames files to prevent collisions
✅ Stores files outside public directory
🚀 Final Thoughts
Now you can handle file uploads securely and efficiently!
✅ Use move_uploaded_file() for safe uploads
✅ Validate file type and size
✅ Store files securely to prevent attacks
✅ Rename files to avoid collisions
👉 Next: Working with Emails in PHP
Happy coding! 🎉🚀