What potential pitfalls should be considered when allowing users to upload files to different directories in PHP?

Potential pitfalls when allowing users to upload files to different directories in PHP include security vulnerabilities such as directory traversal attacks, where users can upload files to unintended directories or overwrite existing files. To mitigate this risk, it is essential to validate and sanitize user input, restrict file types, and use a secure upload directory outside of the web root. 

// Validate and sanitize user input
$uploadDir = '/path/to/uploads/';
$allowedTypes = ['image/jpeg', 'image/png'];
if(isset($_FILES['file']) && $_FILES['file']['error'] === UPLOAD_ERR_OK) {
    $fileType = mime_content_type($_FILES['file']['tmp_name']);
    if(in_array($fileType, $allowedTypes)) {
        $fileName = basename($_FILES['file']['name']);
        $uploadPath = $uploadDir . $fileName;
        move_uploaded_file($_FILES['file']['tmp_name'], $uploadPath);
        echo 'File uploaded successfully!';
    } else {
        echo 'Invalid file type. Allowed types: ' . implode(', ', $allowedTypes);
    }
} else {
    echo 'Error uploading file.';
}

Keywords

file upload directory traversal security vulnerabilities file permissions validation

Related Questions