What are some best practices for implementing an upload field in PHP forms?

When implementing an upload field in PHP forms, it is important to validate the file type, size, and ensure secure file handling to prevent security vulnerabilities such as file injection attacks. One best practice is to use PHP's built-in functions like `move_uploaded_file()` to securely move the uploaded file to a designated directory on the server. 

<?php
if ($_SERVER["REQUEST_METHOD"] == "POST" && isset($_FILES["file"])) {
    $file = $_FILES["file"];

    // Validate file type
    $allowed_types = array("image/jpeg", "image/png", "image/gif");
    if (!in_array($file["type"], $allowed_types)) {
        echo "Invalid file type.";
        exit;
    }

    // Validate file size
    if ($file["size"] > 5000000) {
        echo "File is too large.";
        exit;
    }

    // Move uploaded file to designated directory
    $upload_dir = "uploads/";
    $upload_path = $upload_dir . basename($file["name"]);
    if (move_uploaded_file($file["tmp_name"], $upload_path)) {
        echo "File uploaded successfully.";
    } else {
        echo "Error uploading file.";
    }
}
?>

Keywords

file upload PHP forms enctype move_uploaded_file file validation

Related Questions