What are the best practices for validating and filtering file uploads in PHP to prevent malicious file uploads?

File uploads in PHP can be a security risk if not properly validated and filtered. To prevent malicious file uploads, it is important to restrict the types of files that can be uploaded, check the file size, and sanitize the file name to prevent directory traversal attacks. Additionally, storing uploaded files in a separate directory outside of the web root can help prevent direct access to uploaded files. 

// Validate and filter file uploads in PHP
if(isset($_FILES['file'])){
    $file = $_FILES['file'];

    // Check file type
    $allowedTypes = array('image/jpeg', 'image/png', 'image/gif');
    if(!in_array($file['type'], $allowedTypes)){
        die('Invalid file type. Only JPEG, PNG, and GIF files are allowed.');
    }

    // Check file size
    if($file['size'] > 5242880){ // 5MB
        die('File size is too large. Maximum file size allowed is 5MB.');
    }

    // Sanitize file name
    $fileName = preg_replace("/[^A-Za-z0-9.]/", '', $file['name']);

    // Move uploaded file to a secure directory
    $uploadDir = 'uploads/';
    if(!is_dir($uploadDir)){
        mkdir($uploadDir);
    }
    move_uploaded_file($file['tmp_name'], $uploadDir . $fileName);
    echo 'File uploaded successfully.';
}

Keywords

file uploads validation filtering security PHP

Related Questions