What are the recommended steps for properly handling file uploads in PHP before storing them in a database?

When handling file uploads in PHP, it is important to properly validate and sanitize the uploaded file before storing it in a database to prevent security vulnerabilities such as file injection attacks. One recommended approach is to check the file type, size, and ensure it is not executable. Additionally, it's crucial to move the uploaded file to a secure directory on the server to prevent direct access. 

// Check if file was uploaded without errors
if(isset($_FILES['file']) && $_FILES['file']['error'] == 0){
    $file_name = $_FILES['file']['name'];
    $file_size = $_FILES['file']['size'];
    $file_tmp = $_FILES['file']['tmp_name'];
    $file_type = $_FILES['file']['type'];
    
    // Validate file type
    $allowed_extensions = array("jpg", "jpeg", "png");
    $file_extension = pathinfo($file_name, PATHINFO_EXTENSION);
    if(!in_array($file_extension, $allowed_extensions)){
        die("Invalid file type. Allowed types: jpg, jpeg, png");
    }
    
    // Validate file size
    if($file_size > 500000){
        die("File is too large. Max size is 500KB");
    }
    
    // Move uploaded file to secure directory
    $upload_dir = "uploads/";
    $new_file_name = uniqid() . "_" . $file_name;
    if(move_uploaded_file($file_tmp, $upload_dir . $new_file_name)){
        echo "File uploaded successfully.";
    } else {
        die("Error uploading file.");
    }
} else {
    die("Error uploading file.");
}

Keywords

file uploads PHP database validation security

Related Questions