What are some common pitfalls when creating a contact form in PHP, especially related to access rights and file extensions?

One common pitfall when creating a contact form in PHP is not properly validating file extensions and access rights for uploaded files. This can lead to security vulnerabilities such as allowing malicious files to be uploaded or executed on the server. To solve this issue, you should always validate the file extension and set appropriate access rights to prevent unauthorized access to uploaded files. 

// Validate file extension before uploading
$allowedExtensions = array('jpg', 'jpeg', 'png', 'pdf');
$uploadedFile = $_FILES['file']['name'];
$ext = pathinfo($uploadedFile, PATHINFO_EXTENSION);

if (!in_array($ext, $allowedExtensions)) {
    echo "Invalid file format. Only JPG, JPEG, PNG, and PDF files are allowed.";
    exit;
}

// Set appropriate access rights for uploaded files
$uploadDir = 'uploads/';
$uploadFile = $uploadDir . basename($_FILES['file']['name']);

if (move_uploaded_file($_FILES['file']['tmp_name'], $uploadFile)) {
    echo "File uploaded successfully.";
} else {
    echo "Error uploading file.";
}

Keywords

Access rights file extensions form validation PHP security error handling

Related Questions