Summary - File upload

PHP course · Intermediate · Lesson 81/115

Build a profile picture upload with $_FILES, move_uploaded_file and validation.

Summary - File upload

In this group you learned five core concepts of file upload:

Reading file metadata with the $_FILES superglobal
Moving the temp file with move_uploaded_file()
MIME type validation with in_array()
Size limit checks with the size field
Meaningful error messages from error codes

You will combine them in a profile picture upload function: first check the error code, then the type, then the size, and finally move the file.

Exercise Profile picture upload

Write an uploadProfilePicture(array $file, string $dir): string function. First, if $file['error'] !== UPLOAD_ERR_OK, return 'Error: code ' . $file['error']. Then define $allowed = ['image/png', 'image/jpeg']; if !in_array($file['type'], $allowed, true), return 'Rejected: ' . $file['type']. Then if $file['size'] > 2097152, return 'Too large: ' . $file['size']. Finally build $destination = $dir . '/' . basename($file['name']), call move_uploaded_file($file['tmp_name'], $destination) and return 'OK: ' . $destination. For testing, define $_FILES['avatar'] (name: 'profile.png', type: 'image/png', tmp_name: '/tmp/phpAbCd.tmp', error: 0, size: 102400) and write echo uploadProfilePicture($_FILES['avatar'], 'uploads') . "\n".

Show example solution

' + destination.
Example solution:
<?php
// Upload a profile picture
function uploadProfilePicture(array $file, string $dir): string {
    if ($file['error'] !== UPLOAD_ERR_OK) {
        return "Error: code " . $file['error'];
    }
    $allowed = ['image/png', 'image/jpeg'];
    if (!in_array($file['type'], $allowed, true)) {
        return "Rejected: " . $file['type'];
    }
    if ($file['size'] > 2097152) {
        return "Too large: " . $file['size'];
    }
    $destination = $dir . '/' . basename($file['name']);
    move_uploaded_file($file['tmp_name'], $destination);
    return "OK: " . $destination;
}

$_FILES['avatar'] = [
    'name' => 'profile.png',
    'type' => 'image/png',
    'tmp_name' => '/tmp/phpAbCd.tmp',
    'error' => 0,
    'size' => 102400
];

echo uploadProfilePicture($_FILES['avatar'], 'uploads') . "\n";

Tips for file upload

Tips to keep in mind for file uploads:

Always use enctype="multipart/form-data" on the form.
Check the error code, MIME type and size before moving.
Use basename() when building the destination to block path traversal.
Do not trust the user-sent type field; use finfo if needed.
Store uploaded files outside the web root or in a dedicated folder.

In the next group we will look at sessions for tracking users.

Test yourself

Match all concepts

$_FILES

File metadata
move_uploaded_file

Moves temp file
in_array

Validates type
$_FILES['size']

Returns size
UPLOAD_ERR_OK

No error
What should you always do before calling move_uploaded_file?
- Validate the error code, type and size
- Print the file with echo first
- Call rename
- Delete tmp_name
Show answer

Validate the error code, type and size — Correct. Validation before moving is essential.

Summary - File upload