What are some common pitfalls when using PHP upload scripts?

One common pitfall when using PHP upload scripts is not properly validating file types before allowing them to be uploaded. This can lead to security vulnerabilities such as allowing malicious files to be uploaded to the server. To solve this issue, always validate the file type using a whitelist of allowed file extensions before moving the file to the upload directory. 

<?php
$allowed_extensions = array('jpg', 'jpeg', 'png', 'gif');
$uploaded_file_extension = pathinfo($_FILES['file']['name'], PATHINFO_EXTENSION);

if (!in_array($uploaded_file_extension, $allowed_extensions)) {
    // File type not allowed, handle error or reject upload
    echo "Invalid file type. Only JPG, JPEG, PNG, and GIF files are allowed.";
} else {
    // Move uploaded file to upload directory
    move_uploaded_file($_FILES['file']['tmp_name'], 'uploads/' . $_FILES['file']['name']);
}
?>

Related Questions