Are there any best practices for handling file uploads in PHP to ensure only the filename is stored in the database?

When handling file uploads in PHP, it's important to ensure that only the filename is stored in the database to prevent security risks such as directory traversal attacks. To achieve this, you can use PHP's basename() function to extract the filename from the uploaded file path before storing it in the database. 

// Get the filename from the uploaded file
$filename = basename($_FILES['file']['name']);

// Store the filename in the database
// Example query: INSERT INTO files (filename) VALUES ('$filename');

Keywords

file uploads PHP database filename security

Related Questions