What security measures should be implemented when allowing users to upload files in PHP?

When allowing users to upload files in PHP, it is important to implement security measures to prevent malicious files from being uploaded. One common security measure is to restrict the file types that can be uploaded, validate the file size, and store the uploaded files outside of the web root directory to prevent direct access. 

// Check if the file is a valid image type
$allowedTypes = array('image/jpeg', 'image/png', 'image/gif');
if (!in_array($_FILES['file']['type'], $allowedTypes)) {
    die('Invalid file type. Only JPEG, PNG, and GIF files are allowed.');
}

// Check if the file size is within limit
$maxFileSize = 1048576; // 1MB
if ($_FILES['file']['size'] > $maxFileSize) {
    die('File size exceeds limit. Maximum file size allowed is 1MB.');
}

// Move the uploaded file to a secure directory
$uploadDir = 'uploads/';
$uploadFile = $uploadDir . basename($_FILES['file']['name']);
if (move_uploaded_file($_FILES['file']['tmp_name'], $uploadFile)) {
    echo 'File uploaded successfully.';
} else {
    echo 'Failed to upload file.';
}

Keywords

file upload security measures PHP validation file type detection

Related Questions