What is the best practice for handling file uploads in PHP forms?

When handling file uploads in PHP forms, it is important to ensure that the uploaded files are secure and that the server is properly configured to handle them. One common best practice is to validate the file type and size before allowing the upload to prevent any malicious content from being uploaded to the server. Additionally, it is recommended to store the uploaded files in a secure directory outside of the web root to prevent direct access to them. 

<?php
if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_FILES['file'])) {
    $file = $_FILES['file'];

    // Check file type
    $allowedTypes = ['image/jpeg', 'image/png'];
    if (!in_array($file['type'], $allowedTypes)) {
        die('Invalid file type. Only JPEG and PNG files are allowed.');
    }

    // Check file size
    if ($file['size'] > 1000000) {
        die('File is too large. Maximum file size is 1MB.');
    }

    // Move file to secure directory
    $uploadDir = '/path/to/secure/directory/';
    $uploadFile = $uploadDir . basename($file['name']);

    if (move_uploaded_file($file['tmp_name'], $uploadFile)) {
        echo 'File uploaded successfully.';
    } else {
        echo 'Failed to upload file.';
    }
}
?>

Keywords

file uploads PHP forms handling best practice error types

Related Questions