Admin

Software Developer

Add your Tutorial

21st June, 2026

195

PHP File Upload Tutorial: Secure Upload System with Validation

Introduction

File upload is a common feature in web applications — profile pictures, documents, media files. However, implementing it incorrectly can expose your server to serious security risks. This tutorial shows you how to build a secure PHP file upload system with proper validation, error handling, and security measures.

Step 1: Create Upload Directory

project/
├── uploads/           # Main upload directory
│   ├── images/        # For image uploads
│   ├── documents/     # For document uploads
│   └── .htaccess      # Security rules
├── index.php          # Upload form
└── upload.php         # Upload handler

Step 2: Security .htaccess for Uploads Folder

# uploads/.htaccess
Options -Indexes
RemoveHandler .php .phtml .php3 .php4 .php5 .php7 .phps .cgi .pl .shtml
AddType text/plain .php .phtml .php3 .php4 .php5 .php7 .phps .cgi .pl
<FilesMatch "\.(php|phtml|php3|php4|php5|php7|phps|cgi|pl|shtml)$">
    Deny from all
</FilesMatch>

Step 3: Upload Form (index.php)

<?php
session_start();
// Generate CSRF token
if (!isset($_SESSION['csrf_token'])) {
    $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
}

$message = $_SESSION['upload_message'] ?? '';
$message_type = $_SESSION['upload_message_type'] ?? '';
unset($_SESSION['upload_message'], $_SESSION['upload_message_type']);
?>

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>PHP File Upload</title>
    <link href="https://cdn.jsdelivr.net/npm/[email protected]/dist/css/bootstrap.min.css" rel="stylesheet">
</head>
<body class="bg-light">
    <div class="container mt-5">
        <div class="row">
            <div class="col-md-6 mx-auto">
                <div class="card shadow">
                    <div class="card-header bg-primary text-white">
                        <h4 class="mb-0">Upload File</h4>
                    </div>
                    <div class="card-body">
                        <?php if ($message): ?>
                            <div class="alert alert-<?= $message_type ?> alert-dismissible fade show">
                                <?= htmlspecialchars($message) ?>
                                <button type="button" class="btn-close" data-bs-dismiss="alert"></button>
                            </div>
                        <?php endif; ?>

                        <form action="upload.php" method="POST" enctype="multipart/form-data">
                            <input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>">
                            
                            <div class="mb-3">
                                <label class="form-label">Select File</label>
                                <input type="file" name="uploaded_file" class="form-control" required accept="image/*,.pdf,.doc,.docx">
                            </div>

                            <div class="mb-3">
                                <small class="text-muted">
                                    Allowed: JPG, PNG, GIF, PDF, DOC, DOCX<br>
                                    Maximum size: 5MB
                                </small>
                            </div>

                            <button type="submit" name="submit" class="btn btn-primary w-100">Upload File</button>
                        </form>
                    </div>
                </div>
            </div>
        </div>
    </div>
</body>
</html>

Step 4: Upload Handler (upload.php)

<?php
session_start();

// CSRF Validation
if (!isset($_POST['csrf_token']) || !isset($_SESSION['csrf_token']) || 
    $_POST['csrf_token'] !== $_SESSION['csrf_token']) {
    $_SESSION['upload_message'] = "Invalid security token.";
    $_SESSION['upload_message_type'] = "danger";
    header("Location: index.php");
    exit;
}

// Check if file was uploaded
if (!isset($_FILES['uploaded_file']) || $_FILES['uploaded_file']['error'] === UPLOAD_ERR_NO_FILE) {
    $_SESSION['upload_message'] = "Please select a file to upload.";
    $_SESSION['upload_message_type'] = "danger";
    header("Location: index.php");
    exit;
}

$file = $_FILES['uploaded_file'];

// Define upload configuration
$config = [
    'max_file_size' => 5 * 1024 * 1024, // 5MB
    'upload_dir' => 'uploads/',
    'allowed_types' => [
        'image/jpeg',
        'image/png',
        'image/gif',
        'application/pdf',
        'application/msword',
        'application/vnd.openxmlformats-officedocument.wordprocessingml.document'
    ],
    'allowed_extensions' => ['jpg', 'jpeg', 'png', 'gif', 'pdf', 'doc', 'docx']
];

// Validate for upload errors
$error_messages = [
    UPLOAD_ERR_INI_SIZE => "File exceeds upload_max_filesize directive.",
    UPLOAD_ERR_FORM_SIZE => "File exceeds MAX_FILE_SIZE directive.",
    UPLOAD_ERR_PARTIAL => "File was only partially uploaded.",
    UPLOAD_ERR_NO_FILE => "No file was uploaded.",
    UPLOAD_ERR_NO_TMP_DIR => "Missing temporary folder.",
    UPLOAD_ERR_CANT_WRITE => "Failed to write file to disk.",
    UPLOAD_ERR_EXTENSION => "A PHP extension stopped the file upload."
];

if ($file['error'] !== UPLOAD_ERR_OK) {
    $error_msg = $error_messages[$file['error']] ?? "Unknown upload error.";
    $_SESSION['upload_message'] = $error_msg;
    $_SESSION['upload_message_type'] = "danger";
    header("Location: index.php");
    exit;
}

// Validate file size
if ($file['size'] > $config['max_file_size']) {
    $_SESSION['upload_message'] = "File is too large. Maximum size is 5MB.";
    $_SESSION['upload_message_type'] = "danger";
    header("Location: index.php");
    exit;
}

// Get file MIME type securely
$finfo = new finfo(FILEINFO_MIME_TYPE);
$mime_type = $finfo->file($file['tmp_name']);

// Validate MIME type
if (!in_array($mime_type, $config['allowed_types'])) {
    $_SESSION['upload_message'] = "Invalid file type. Allowed types: JPG, PNG, GIF, PDF, DOC, DOCX.";
    $_SESSION['upload_message_type'] = "danger";
    header("Location: index.php");
    exit;
}

// Get file extension
$file_extension = strtolower(pathinfo($file['name'], PATHINFO_EXTENSION));

// Validate file extension
if (!in_array($file_extension, $config['allowed_extensions'])) {
    $_SESSION['upload_message'] = "Invalid file extension.";
    $_SESSION['upload_message_type'] = "danger";
    header("Location: index.php");
    exit;
}

// Generate safe filename
$new_filename = bin2hex(random_bytes(16)) . '.' . $file_extension;

// Determine subdirectory based on file type
if (strpos($mime_type, 'image/') === 0) {
    $upload_path = $config['upload_dir'] . 'images/';
} else {
    $upload_path = $config['upload_dir'] . 'documents/';
}

// Create directory if it doesn't exist
if (!is_dir($upload_path)) {
    mkdir($upload_path, 0755, true);
}

$destination = $upload_path . $new_filename;

// Move uploaded file
if (move_uploaded_file($file['tmp_name'], $destination)) {
    $_SESSION['upload_message'] = "File uploaded successfully!";
    $_SESSION['upload_message_type'] = "success";
    
    // Optional: Store file info in database
    // storeFileInfo($new_filename, $file['name'], $mime_type, $file['size'], $destination);
} else {
    $_SESSION['upload_message'] = "Failed to upload file. Please try again.";
    $_SESSION['upload_message_type'] = "danger";
}

header("Location: index.php");
exit;

Step 5: Multiple File Upload Version

<?php
// multiple-upload.php
session_start();

if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_FILES['files'])) {
    $files = $_FILES['files'];
    $upload_dir = 'uploads/images/';
    $allowed_types = ['image/jpeg', 'image/png', 'image/gif'];
    $max_size = 5 * 1024 * 1024;
    $success_count = 0;
    $error_count = 0;
    $errors = [];

    if (!is_dir($upload_dir)) {
        mkdir($upload_dir, 0755, true);
    }

    for ($i = 0; $i < count($files['name']); $i++) {
        if ($files['error'][$i] !== UPLOAD_ERR_OK) {
            $errors[] = "Error with file: " . $files['name'][$i];
            $error_count++;
            continue;
        }

        if ($files['size'][$i] > $max_size) {
            $errors[] = $files['name'][$i] . " exceeds maximum size.";
            $error_count++;
            continue;
        }

        $finfo = new finfo(FILEINFO_MIME_TYPE);
        $mime_type = $finfo->file($files['tmp_name'][$i]);

        if (!in_array($mime_type, $allowed_types)) {
            $errors[] = $files['name'][$i] . " is not an allowed file type.";
            $error_count++;
            continue;
        }

        $extension = strtolower(pathinfo($files['name'][$i], PATHINFO_EXTENSION));
        $new_name = uniqid('img_', true) . '.' . $extension;
        $destination = $upload_dir . $new_name;

        if (move_uploaded_file($files['tmp_name'][$i], $destination)) {
            $success_count++;
        } else {
            $errors[] = "Failed to upload: " . $files['name'][$i];
            $error_count++;
        }
    }

    echo "Uploaded: $success_count files successfully.<br>";
    echo "Failed: $error_count files.<br>";
    if (!empty($errors)) {
        echo "Errors: " . implode(", ", $errors);
    }
}
?>

<form action="" method="POST" enctype="multipart/form-data">
    <input type="file" name="files[]" multiple accept="image/*">
    <button type="submit">Upload Multiple Files</button>
</form>

Step 6: Image Upload with Resize

<?php
function resizeImage($source_path, $destination_path, $max_width = 800, $max_height = 600, $quality = 80) {
    // Get image info
    $image_info = getimagesize($source_path);
    $mime_type = $image_info['mime'];
    $orig_width = $image_info[0];
    $orig_height = $image_info[1];

    // Calculate new dimensions
    $ratio = $orig_width / $orig_height;
    
    if ($max_width / $max_height > $ratio) {
        $new_height = $max_height;
        $new_width = $max_height * $ratio;
    } else {
        $new_width = $max_width;
        $new_height = $max_width / $ratio;
    }

    // Create new image resource
    $new_image = imagecreatetruecolor($new_width, $new_height);

    // Load source image based on type
    switch ($mime_type) {
        case 'image/jpeg':
            $source_image = imagecreatefromjpeg($source_path);
            break;
        case 'image/png':
            $source_image = imagecreatefrompng($source_path);
            imagealphablending($new_image, false);
            imagesavealpha($new_image, true);
            break;
        case 'image/gif':
            $source_image = imagecreatefromgif($source_path);
            break;
        default:
            return false;
    }

    // Resize
    imagecopyresampled(
        $new_image, $source_image,
        0, 0, 0, 0,
        $new_width, $new_height,
        $orig_width, $orig_height
    );

    // Save resized image
    switch ($mime_type) {
        case 'image/jpeg':
            imagejpeg($new_image, $destination_path, $quality);
            break;
        case 'image/png':
            imagepng($new_image, $destination_path, 8);
            break;
        case 'image/gif':
            imagegif($new_image, $destination_path);
            break;
    }

    // Free memory
    imagedestroy($source_image);
    imagedestroy($new_image);
    
    return true;
}

// Usage after file upload
if (strpos($mime_type, 'image/') === 0) {
    $thumbnail_path = $upload_path . 'thumb_' . $new_filename;
    resizeImage($destination, $thumbnail_path, 300, 300, 80);
}

Common Upload Errors and Solutions

<?php
// Increase upload limits in php.ini or .htaccess
// php.ini
upload_max_filesize = 10M
post_max_size = 12M
max_file_uploads = 20
max_execution_time = 60

// .htaccess
php_value upload_max_filesize 10M
php_value post_max_size 12M
php_value max_file_uploads 20

Conclusion

You now have a secure PHP file upload system featuring:

File type and MIME validation
Size restrictions
CSRF protection
Secure filename generation
Directory protection
Multiple file upload support
Image resizing capabilities

Popular Tools for Developers

Free Sample Files (Image,Video,Audio,Documents) For Testing CSS Minifier Js Minifier JSON Viewer and Formatter

Popular Tools for Project Manager

SSL Checker

Popular Tools for Youtubers

BIC Code(Swift Code) for Adsense Generate YouTube Subscribe Button

Other Tools for Daily Life

Google drive sharelink to download link.

Admin

Related Tutorial

Popular Tools for Developers

Popular Tools for Project Manager

Popular Tools for Youtubers

Other Tools for Daily Life

About us

Find Online Tools

Quick links

Social links

Other