What potential pitfalls should be considered when using $_FILES to handle file uploads in PHP?

One potential pitfall when using $_FILES to handle file uploads in PHP is the risk of file upload vulnerabilities, such as allowing malicious files to be uploaded to the server. To mitigate this risk, it is important to validate the file type and size before moving the uploaded file to a secure location on the server. 

// Validate file type and size before moving the uploaded file
$allowedFileTypes = ['jpg', 'jpeg', 'png', 'gif'];
$maxFileSize = 5242880; // 5MB

if (in_array(pathinfo($_FILES['file']['name'], PATHINFO_EXTENSION), $allowedFileTypes) && $_FILES['file']['size'] <= $maxFileSize) {
    move_uploaded_file($_FILES['file']['tmp_name'], 'uploads/' . $_FILES['file']['name']);
    echo 'File uploaded successfully!';
} else {
    echo 'Invalid file type or size. Please upload a file less than 5MB in size and in JPG, JPEG, PNG, or GIF format.';
}

Keywords

$_FILES file uploads security vulnerabilities file size limits file type validation

Related Questions