What are some best practices for implementing an upload script in PHP on a website?

When implementing an upload script in PHP on a website, it is important to ensure that the uploaded files are secure and that the script can handle various file types and sizes. Best practices include validating file types, checking file sizes, and storing uploaded files in a secure directory on the server. 

<?php
// Check if a file has been uploaded
if(isset($_FILES['file'])){
    $file = $_FILES['file'];

    // Validate file type
    $allowedTypes = ['image/jpeg', 'image/png', 'image/gif'];
    if(!in_array($file['type'], $allowedTypes)){
        die('Invalid file type. Allowed types: jpeg, png, gif');
    }

    // Check file size
    if($file['size'] > 5242880){ // 5MB in bytes
        die('File is too large. Max file size is 5MB');
    }

    // Move uploaded file to a secure directory
    $uploadDir = 'uploads/';
    $uploadFile = $uploadDir . basename($file['name']);
    if(move_uploaded_file($file['tmp_name'], $uploadFile)){
        echo 'File uploaded successfully';
    } else {
        echo 'Error uploading file';
    }
}
?>

Keywords

file upload PHP script security measures error handling file validation

Related Questions