What are the best practices for handling file uploads and transfers in PHP scripts?

When handling file uploads and transfers in PHP scripts, it is important to validate and sanitize user input to prevent security vulnerabilities such as file injection attacks. It is also recommended to set appropriate file size limits, check file types, and store uploaded files in a secure location outside the web root directory to prevent direct access. 

<?php
// Check if file was uploaded without errors
if(isset($_FILES['file']) && $_FILES['file']['error'] == 0){
    $uploadDir = 'uploads/';
    $uploadFile = $uploadDir . basename($_FILES['file']['name']);

    // Validate file size
    if($_FILES['file']['size'] > 1000000){
        echo 'File is too large.';
    }

    // Validate file type
    $allowedTypes = array('jpg', 'jpeg', 'png', 'gif');
    $fileType = pathinfo($uploadFile, PATHINFO_EXTENSION);
    if(!in_array($fileType, $allowedTypes)){
        echo 'Invalid file type.';
    }

    // Move uploaded file to secure location
    if(move_uploaded_file($_FILES['file']['tmp_name'], $uploadFile)){
        echo 'File uploaded successfully.';
    } else {
        echo 'Error uploading file.';
    }
}
?>

Keywords

file uploads PHP scripts handling transfers best practices

Related Questions