What are the potential security risks of allowing users to choose file names for uploads in PHP?

Allowing users to choose file names for uploads in PHP can pose security risks such as directory traversal attacks, where users can potentially upload files with malicious names that can access sensitive files on the server. To mitigate this risk, it is recommended to generate a unique filename for each uploaded file to prevent any malicious intent. 

// Generate a unique filename for the uploaded file
$unique_filename = uniqid() . '_' . $_FILES['file']['name'];
move_uploaded_file($_FILES['file']['tmp_name'], 'uploads/' . $unique_filename);

Keywords

file uploads security risks user input validation file naming

Related Questions