How can file upload functionality be improved in PHP to prevent potential security vulnerabilities?

To improve file upload functionality in PHP and prevent potential security vulnerabilities, it is crucial to validate file types, limit file size, and store uploaded files in a secure directory outside the web root. 

// Validate file type
$allowedExtensions = array('jpg', 'jpeg', 'png', 'gif');
$extension = pathinfo($_FILES['file']['name'], PATHINFO_EXTENSION);
if (!in_array($extension, $allowedExtensions)) {
    die('Invalid file type.');
}

// Limit file size
$maxFileSize = 1048576; // 1MB
if ($_FILES['file']['size'] > $maxFileSize) {
    die('File size exceeds limit.');
}

// Store uploaded file in a secure directory
$uploadDirectory = '/path/to/uploaded/files/';
$uploadPath = $uploadDirectory . basename($_FILES['file']['name']);
if (move_uploaded_file($_FILES['file']['tmp_name'], $uploadPath)) {
    echo 'File uploaded successfully.';
} else {
    echo 'File upload failed.';
}

Keywords

file upload security vulnerabilities PHP validation file type detection

Related Questions