```html Secure File Uploads in PHP - Stack Exchange
StackExchange
5

How to securely handle user file uploads in PHP?

Asked 2 hours ago • by user123

What are the best practices for securely implementing file upload functionality in PHP applications?

I understand the basics of using $_FILES and moving files to a target directory, but what specific methods should I use to prevent malicious uploads? Are there built-in PHP functions for verifying file types and detecting malicious content?

2 Answers

10
Answered by ExpertDev • 1 hour ago

Implement secure file uploads in PHP by:

  1. Validate file types using mimetype checking rather than relying on file extensions
  2. Use move_uploaded_file() with a secure destination directory
  3. Limit file sizes with max_file_size in PHP.ini and server config
  4. Use secure random names for uploaded files
  5. Scan files with ClamAV or similar security software before processing

<?php
// Example secure upload implementation
$allowed = ['image/jpeg', 'image/png'];
if (isset($_FILES['file']) && in_array($_FILES['file']['type'], $allowed)) {
    $name = bin2hex(random_bytes(16)) . '.' . pathinfo($_FILES['file']['name'], PATHINFO_EXTENSION);
    move_uploaded_file($_FILES['file']['tmp_name'], '/secure/uploads/' . $name);
}
?>
4
Answered by SecPro • 45 mins ago

For enhanced security:

  • Use PHP's filter_var() for additional validation
  • Isolate uploaded files in a non-web-accessible directory
  • Implement rate-limiting to prevent upload abuse
  • Log failed attempts with error_get_last()
Post Your Answer
```