What best practices should be followed when handling file uploads in PHP to ensure security and efficiency?

When handling file uploads in PHP, it is important to validate the file type, size, and content to prevent malicious files from being uploaded. Additionally, it is recommended to store uploaded files outside the web root directory to prevent direct access. Finally, consider using a unique file naming convention to prevent overwriting existing files. 

// Validate file type, size, and content
if ($_FILES['file']['error'] === UPLOAD_ERR_OK) {
    $allowedTypes = ['image/jpeg', 'image/png'];
    $maxSize = 1048576; // 1MB

    if (in_array($_FILES['file']['type'], $allowedTypes) && $_FILES['file']['size'] <= $maxSize) {
        // Store uploaded file outside web root directory
        $uploadDir = 'uploads/';
        $uploadFile = $uploadDir . uniqid() . '_' . basename($_FILES['file']['name']);

        if (move_uploaded_file($_FILES['file']['tmp_name'], $uploadFile)) {
            echo 'File uploaded successfully!';
        } else {
            echo 'Error uploading file.';
        }
    } else {
        echo 'Invalid file type or size.';
    }
} else {
    echo 'Error uploading file.';
}

Keywords

file uploads PHP security efficiency validation

Related Questions