What are some best practices for handling file uploads in PHP to ensure both functionality and security?

When handling file uploads in PHP, it is important to validate the file type, size, and content to prevent malicious files from being uploaded. Additionally, it is crucial to store uploaded files in a secure directory outside of the web root to prevent direct access. Using PHP's built-in file handling functions and sanitizing user input can help ensure both functionality and security. 

<?php
// Check if a file was uploaded
if(isset($_FILES['file'])){
    $file = $_FILES['file'];

    // Validate file type
    $allowedTypes = ['image/jpeg', 'image/png'];
    if(!in_array($file['type'], $allowedTypes)){
        die('Invalid file type.');
    }

    // Validate file size
    if($file['size'] > 1000000){
        die('File is too large.');
    }

    // Sanitize file name
    $fileName = preg_replace("/[^A-Za-z0-9.]/", '', $file['name']);

    // Move uploaded file to secure directory
    $uploadDir = 'uploads/';
    $uploadPath = $uploadDir . $fileName;
    if(move_uploaded_file($file['tmp_name'], $uploadPath)){
        echo 'File uploaded successfully.';
    } else {
        echo 'Failed to upload file.';
    }
}
?>

Keywords

file uploads PHP security validation move_uploaded_file

Related Questions