What are the potential security risks when saving files using PHP?

When saving files using PHP, there are potential security risks such as allowing malicious files to be uploaded to the server, executing arbitrary code, and exposing sensitive information. To mitigate these risks, it is important to validate file types, sanitize file names, and store files outside the web root directory. 

// Example of saving a file securely in PHP

$uploadDir = '/path/to/uploads/';
$allowedTypes = ['jpg', 'png'];

if(isset($_FILES['file'])) {
    $file = $_FILES['file'];
    
    $fileName = basename($file['name']);
    $fileType = pathinfo($fileName, PATHINFO_EXTENSION);

    if(in_array($fileType, $allowedTypes)) {
        $targetPath = $uploadDir . $fileName;
        
        if(move_uploaded_file($file['tmp_name'], $targetPath)) {
            echo 'File uploaded successfully.';
        } else {
            echo 'Failed to upload file.';
        }
    } else {
        echo 'Invalid file type.';
    }
}

Keywords

file upload file permissions file validation cross-site scripting SQL injection

Related Questions