All 7 File Upload Handling questions
More in File Upload Handling
How do you move an uploaded file from its temporary location to a permanent storage location using move_uploaded_file? How should you validate an uploaded file's type and size before accepting it, and why is checking only the file extension considered insufficient for security? How do you handle multiple file uploads submitted from a single form field, and what does the resulting $_FILES array structure look like? How should uploaded file names be sanitized and randomized to avoid security risks and naming conflicts when storing files on the server? What security risks arise from allowing file uploads into a publicly accessible directory, and how do you prevent uploaded files from being executed as scripts? How should a large scale application design its file upload architecture to handle high volumes of uploads reliably, including virus scanning and offloading storage to a dedicated service?
Advertisement
Back to results for “Security”
PHP › File Upload Handling

How does PHP handle file uploads submitted through an HTML form, and what information does the $_FILES superglobal provide?

Beginner

Answer

When a user submits a form containing a file input with the proper multipart encoding, PHP automatically stores information about the uploaded file in the $_FILES superglobal, including the file's original name, its temporary server side location, its size, and its MIME type, along with an error code indicating whether the upload succeeded, giving your script everything it needs to validate and then move the uploaded file to a permanent location.
<form method="post" enctype="multipart/form-data">
  <input type="file" name="document">
</form>

$fileName = $_FILES['document']['name'];
$tmpPath = $_FILES['document']['tmp_name'];
Real-world example A document upload feature reads the temporary file path and original file name from the $_FILES superglobal immediately after a form submission, using that information to decide where and under what name to permanently store the uploaded file.

Common follow-ups: Why does the form need the enctype multipart form data attribute for file uploads to work?;What does each possible value of the upload error code mean?

Form Handling & Validation;Security
All 7 File Upload Handling questions