PHP
Summary - File upload
Build a profile picture upload with $_FILES, move_uploaded_file and validation.
Summary - File upload
In this group you learned five core concepts of file upload:
- Reading file metadata with the
$_FILES superglobal - Moving the temp file with
move_uploaded_file() - MIME type validation with
in_array() - Size limit checks with the
size field - Meaningful error messages from
error codes
You will combine them in a profile picture upload function: first check the error code, then the type, then the size, and finally move the file.
Exercise Profile picture upload
Write an uploadProfilePicture(array $file, string $dir): string function. First, if $file['error'] !== UPLOAD_ERR_OK, return 'Error: code ' . $file['error']. Then define $allowed = ['image/png', 'image/jpeg']; if !in_array($file['type'], $allowed, true), return 'Rejected: ' . $file['type']. Then if $file['size'] > 2097152, return 'Too large: ' . $file['size']. Finally build $destination = $dir . '/' . basename($file['name']), call move_uploaded_file($file['tmp_name'], $destination) and return 'OK: ' . $destination. For testing, define $_FILES['avatar'] (name: 'profile.png', type: 'image/png', tmp_name: '/tmp/phpAbCd.tmp', error: 0, size: 102400) and write echo uploadProfilePicture($_FILES['avatar'], 'uploads') . "\n".
Show example solution
' + destination.
Example solution:
<?php
// Upload a profile picture
function uploadProfilePicture(array $file, string $dir): string {
if ($file['error'] !== UPLOAD_ERR_OK) {
return "Error: code " . $file['error'];
}
$allowed = ['image/png', 'image/jpeg'];
if (!in_array($file['type'], $allowed, true)) {
return "Rejected: " . $file['type'];
}
if ($file['size'] > 2097152) {
return "Too large: " . $file['size'];
}
$destination = $dir . '/' . basename($file['name']);
move_uploaded_file($file['tmp_name'], $destination);
return "OK: " . $destination;
}
$_FILES['avatar'] = [
'name' => 'profile.png',
'type' => 'image/png',
'tmp_name' => '/tmp/phpAbCd.tmp',
'error' => 0,
'size' => 102400
];
echo uploadProfilePicture($_FILES['avatar'], 'uploads') . "\n";
Tips for file upload
Tips to keep in mind for file uploads:
- Always use
enctype="multipart/form-data" on the form. - Check the error code, MIME type and size before moving.
- Use
basename() when building the destination to block path traversal. - Do not trust the user-sent
type field; use finfo if needed. - Store uploaded files outside the web root or in a dedicated folder.
In the next group we will look at sessions for tracking users.
Test yourself
-
Match all concepts
- $_FILES
- File metadata
- move_uploaded_file
- Moves temp file
- in_array
- Validates type
- $_FILES['size']
- Returns size
- UPLOAD_ERR_OK
- No error
-
What should you always do before calling move_uploaded_file?
- Validate the error code, type and size
- Print the file with echo first
- Call rename
- Delete tmp_name
Show answer
Validate the error code, type and size — Correct. Validation before moving is essential.
Next lesson: Starting a session with session_start()
