What are some best practices for securely uploading image files (e.g. gif/jpg) in PHP?

When uploading image files in PHP, it is important to validate the file type, size, and ensure that the file is not malicious. One best practice is to use the `getimagesize()` function to check if the uploaded file is an actual image. Additionally, you should store the uploaded files outside of the web root directory to prevent direct access to them. Finally, consider using a unique filename and hashing the file before storing it on the server. 

// Check if the uploaded file is an image
$image_info = getimagesize($_FILES["file"]["tmp_name"]);
if($image_info === false) {
    die("Invalid image file.");
}

// Move the uploaded file to a secure directory
$target_dir = "uploads/";
$target_file = $target_dir . basename($_FILES["file"]["name"]);
move_uploaded_file($_FILES["file"]["tmp_name"], $target_file);

// Use a unique filename and hash the file
$hashed_filename = md5(uniqid()) . '.' . pathinfo($target_file, PATHINFO_EXTENSION);
$hashed_target_file = $target_dir . $hashed_filename;
rename($target_file, $hashed_target_file);

echo "File uploaded successfully.";

Keywords

file upload image files security PHP functions validation

Related Questions