What are the best practices for validating file uploads in PHP to prevent potential vulnerabilities?

File uploads in PHP can be a potential security risk if not properly validated. To prevent vulnerabilities such as malicious file uploads or file injection attacks, it is important to validate the file type, size, and content before allowing it to be uploaded to the server. This can be done by checking the file extension, MIME type, and using functions like `move_uploaded_file()` to securely handle the uploaded file. 

// Validate file upload
$allowedExtensions = ['jpg', 'jpeg', 'png', 'gif'];
$maxFileSize = 1048576; // 1MB

if ($_FILES['file']['error'] === UPLOAD_ERR_OK) {
    $fileExtension = pathinfo($_FILES['file']['name'], PATHINFO_EXTENSION);
    
    if (!in_array($fileExtension, $allowedExtensions)) {
        die('Invalid file extension.');
    }
    
    if ($_FILES['file']['size'] > $maxFileSize) {
        die('File size exceeds limit.');
    }
    
    $uploadPath = 'uploads/' . $_FILES['file']['name'];
    
    if (move_uploaded_file($_FILES['file']['tmp_name'], $uploadPath)) {
        echo 'File uploaded successfully.';
    } else {
        die('Error uploading file.');
    }
} else {
    die('Error uploading file.');
}

Keywords

file uploads validation PHP security vulnerabilities

Related Questions