What are the best practices for handling file uploads in PHP, considering security and server restrictions?

When handling file uploads in PHP, it is important to validate the file type, size, and content to prevent security vulnerabilities such as file injection attacks. Additionally, it is recommended to store uploaded files outside of the web root directory to prevent direct access by users. Finally, consider implementing server-side restrictions on file upload size and execution time to prevent denial of service attacks. 

<?php
// Check if the file was uploaded without errors
if ($_FILES['file']['error'] === UPLOAD_ERR_OK) {
    // Validate file type
    $allowedTypes = ['image/jpeg', 'image/png'];
    if (!in_array($_FILES['file']['type'], $allowedTypes)) {
        die('Invalid file type');
    }

    // Validate file size
    if ($_FILES['file']['size'] > 5000000) { // 5MB
        die('File size is too large');
    }

    // Move the uploaded file to a secure location
    $uploadDir = '/path/to/uploads/';
    $uploadFile = $uploadDir . basename($_FILES['file']['name']);
    if (move_uploaded_file($_FILES['file']['tmp_name'], $uploadFile)) {
        echo 'File is valid, and was successfully uploaded.';
    } else {
        echo 'Upload failed';
    }
} else {
    echo 'Error uploading file';
}
?>

Keywords

file uploads PHP security server restrictions error handling

Related Questions