What potential pitfalls should be considered when passing file uploads to functions in PHP?

When passing file uploads to functions in PHP, it's important to consider potential security vulnerabilities such as file injection attacks. To mitigate this risk, always validate the file type and size before processing it. Additionally, ensure that the file is stored in a secure location on the server and sanitize the file name to prevent any malicious code execution. 

// Example of validating file upload before processing
if(isset($_FILES['file'])) {
    $file = $_FILES['file'];
    
    // Validate file type
    $allowed_types = ['image/jpeg', 'image/png'];
    if(!in_array($file['type'], $allowed_types)) {
        die('Invalid file type. Allowed types are JPEG and PNG.');
    }
    
    // Validate file size
    $max_size = 1048576; // 1MB
    if($file['size'] > $max_size) {
        die('File size exceeds limit of 1MB.');
    }
    
    // Sanitize file name
    $file_name = preg_replace("/[^A-Za-z0-9.]/", '', $file['name']);
    
    // Process the file
    move_uploaded_file($file['tmp_name'], 'uploads/' . $file_name);
}

Related Questions