Processing process of PHP file upload and all aspects involved
HTML Basics
Submit via POST form
PHP upload steps
- The client submits the form via HTTP POST
- After the file is uploaded, it is stored in the default temporary directory. Configure the php.ini attribute upload_tmp_dir and the PHP running environment variable TMPDIR to set the temporary directory. The function putenv setting in the PHP language is invalid
- Use move_upload_file to move the upload from the temporary directory to the specified location (this step is not required if upload_tmp_dir has been set to the specified location)
- If the form does not choose to upload files $_FILES['userfile']['type'] == "" , $_FILES['userfile']['size']== 0
PHP related global predefined variables
- $_POST [array] is used to obtain the parameters submitted by form POST
- $_FILES [array]
- $_FILES['userfile']['name'] Original name of client machine userfile == name attribute in input control
- $_FILES['userfile']['type'] File MIME type
- $_FILES['userfile']['size'] Uploaded file size (bytes)
- $_FILES['userfile']['tmp_name'] The temporary file name stored on the server after the file is uploaded
- $_FILES['userfile']['error'] The error code related to the file upload
PHP related functions
- is_upload_file(string $filename) determines whether the file is uploaded through HTTP POST
- move_upload_file($file,$des) moves the uploaded file to a new location and checks that file is a legal uploaded file
The file names involved in the parameters are all absolute paths
php.ini related settings
- file_uploads [boolean] Whether to allow HTTP file upload
- upload_max_filesize [integer] Maximum size of uploaded files, default 2M
- post_max_size [integer]The maximum size allowed for POST data, this value>upload_max_filesize
- memory_limit [integer]this value>post_max_size
- max_input_time [integer] The upload time starts from when the script is executed and ends when all the data arrives at the server. The default is 60s
- upload_tmp_dir [string] Temporary directory for file upload and storage, writable by the PHP process owner user
- max_execution_time [integer] script execution time, system call, sleep, database query, file upload time does not include
Error message
- [0] UPLOAD_ERR_OK File uploaded successfully
- [1] UPLOAD_ERR_INI_SIZE File upload exceeds UPLOAD_MAX_SIZE
- [2] UPLOAD_ERR_FORM_SIZE The uploaded file size exceeds MAX_FILE_SIZE
- [3] UPLOAD_ERR_PARTIAL File partially uploaded successfully
- [4] UPLOAD_ERR_NO_FILE No file was uploaded
- [6] UPLOAD_ERR_NO_TMP_DIR Temporary folder not found
- [7] UPLOAD_ERR_CANT_WRITE File writing failed
PSP server upload security processing
- Suffix name check
- Size limit
- Content-Type check
- If it is a picture, use getimagesize to check the file type
- Set application directory and upload directory access permissions separately through the server
Articles you may be interested in
- PHP analyzes file header information to determine the type of uploaded file
- php file upload related configuration tutorial
- jquery +html+php implements Ajax file upload without refreshing
- PHP determines the safest and most realistic solution to upload file types
- php implements batch compression and packaging of files for download
- php Program to obtain all files in a directory and save the results to an array
- PHP method to determine whether a string is all in English, pure Chinese, or a combination of Chinese and English
- Powerful PHP image processing class (watermark, transparency , scale, sharpen, rotate, flip, cut, invert)

The article explains how to create, implement, and use interfaces in PHP, focusing on their benefits for code organization and maintainability.

The article discusses the differences between crypt() and password_hash() in PHP for password hashing, focusing on their implementation, security, and suitability for modern web applications.

Article discusses preventing Cross-Site Scripting (XSS) in PHP through input validation, output encoding, and using tools like OWASP ESAPI and HTML Purifier.

Autoloading in PHP automatically loads class files when needed, improving performance by reducing memory use and enhancing code organization. Best practices include using PSR-4 and organizing code effectively.

PHP streams unify handling of resources like files, network sockets, and compression formats via a consistent API, abstracting complexity and enhancing code flexibility and efficiency.

The article discusses managing file upload sizes in PHP, focusing on the default limit of 2MB and how to increase it by modifying php.ini settings.

The article discusses nullable types in PHP, introduced in PHP 7.1, allowing variables or parameters to be either a specified type or null. It highlights benefits like improved readability, type safety, and explicit intent, and explains how to declar

The article discusses the differences between unset() and unlink() functions in programming, focusing on their purposes and use cases. Unset() removes variables from memory, while unlink() deletes files from the filesystem. Both are crucial for effec


Hot AI Tools

Undresser.AI Undress
AI-powered app for creating realistic nude photos

AI Clothes Remover
Online AI tool for removing clothes from photos.

Undress AI Tool
Undress images for free

Clothoff.io
AI clothes remover

Video Face Swap
Swap faces in any video effortlessly with our completely free AI face swap tool!

Hot Article

Hot Tools

ZendStudio 13.5.1 Mac
Powerful PHP integrated development environment

MantisBT
Mantis is an easy-to-deploy web-based defect tracking tool designed to aid in product defect tracking. It requires PHP, MySQL and a web server. Check out our demo and hosting services.

SecLists
SecLists is the ultimate security tester's companion. It is a collection of various types of lists that are frequently used during security assessments, all in one place. SecLists helps make security testing more efficient and productive by conveniently providing all the lists a security tester might need. List types include usernames, passwords, URLs, fuzzing payloads, sensitive data patterns, web shells, and more. The tester can simply pull this repository onto a new test machine and he will have access to every type of list he needs.

Notepad++7.3.1
Easy-to-use and free code editor

DVWA
Damn Vulnerable Web App (DVWA) is a PHP/MySQL web application that is very vulnerable. Its main goals are to be an aid for security professionals to test their skills and tools in a legal environment, to help web developers better understand the process of securing web applications, and to help teachers/students teach/learn in a classroom environment Web application security. The goal of DVWA is to practice some of the most common web vulnerabilities through a simple and straightforward interface, with varying degrees of difficulty. Please note that this software
