Learn how to upload files securely in PHP using best practices for size, type, and extension validation.
📂 Why Secure File Uploads Matter
Allowing users to upload files can add great functionality to your website , from profile pictures to document uploads. However, improper handling can lead to serious security vulnerabilities. This guide walks you through building a secure PHP file upload system.
📝 Step 1: Create the Upload Form
<form method="post" enctype="multipart/form-data"> <label>Upload a file:</label><br> <input type="file" name="uploadedFile" required><br> <button type="submit" name="uploadBtn">Upload</button> </form>⚙️ Step 2: Handle the Upload in PHP
<?php if (isset($_POST['uploadBtn']) && isset($_FILES['uploadedFile'])) { $fileTmpPath = $_FILES['uploadedFile']['tmp_name']; $fileName = $_FILES['uploadedFile']['name']; $fileSize = $_FILES['uploadedFile']['size']; $fileType = $_FILES['uploadedFile']['type']; $fileNameCmps = explode(".", $fileName); $fileExtension = strtolower(end($fileNameCmps)); $allowedfileExtensions = ['jpg', 'jpeg', 'png', 'gif', 'pdf']; $maxFileSize = 2 * 1024 * 1024; // 2MB if (in_array($fileExtension, $allowedfileExtensions)) { if ($fileSize <= $maxFileSize) { $uploadFileDir = './uploads/'; $newFileName = md5(time() . $fileName) . '.' . $fileExtension; $dest_path = $uploadFileDir . $newFileName; if (move_uploaded_file($fileTmpPath, $dest_path)) { echo 'File is successfully uploaded.'; } else { echo 'Error moving the uploaded file.'; } } else { echo 'File exceeds the maximum allowed size of 2MB.'; } } else { echo 'Upload failed. Allowed file types: ' . implode(', ', $allowedfileExtensions); } } ?>🔐 Security Best Practices
- Never trust the file extension alone , always check the MIME type if possible
- Use
getimagesize()to validate image uploads - Store uploaded files outside the web root or in protected directories
- Rename files to avoid overwriting and to prevent executing arbitrary code
- Set correct file permissions (e.g., 0644 for files)
✨ Enhancements You Can Add
- Show file preview for image uploads using JavaScript
- Log upload attempts with user info and timestamps
- Scan uploads with antivirus software
- Restrict upload access to logged-in users