Build a Secure File Upload Pipeline in PHP

Last updated: August 29, 2026.

A safe upload handler distrusts the browser-supplied filename and MIME type. Check the upload error, enforce a size limit, inspect the real file type, and create a server-side filename.

Validate and move the upload

<?php
$file = $_FILES['document'] ?? null;
if (!$file || $file['error'] !== UPLOAD_ERR_OK) throw new RuntimeException('Upload failed.');
if ($file['size'] > 5 * 1024 * 1024) throw new RuntimeException('File is too large.');
$mime = (new finfo(FILEINFO_MIME_TYPE))->file($file['tmp_name']);
$allowed = ['image/jpeg' => 'jpg', 'image/png' => 'png', 'application/pdf' => 'pdf'];
if (!isset($allowed[$mime])) throw new RuntimeException('Unsupported type.');
$name = bin2hex(random_bytes(16)) . '.' . $allowed[$mime];
if (!move_uploaded_file($file['tmp_name'], dirname(__DIR__) . '/private-uploads/' . $name)) throw new RuntimeException('Storage failed.');

Apply defense in depth

• Keep uploads outside executable web directories.
• Serve private downloads through authorization.
• Escape the original filename before display.
• Limit image dimensions as well as byte size.
• Scan risky documents when malware scanning is available.

Separate acceptance from publication

Store an accepted upload under a server-generated name before making it available to other users. Authorization, malware scanning, image processing, and download headers are separate decisions from receiving the bytes.

Test an oversized file, a renamed executable, an interrupted upload, and two files with the same original name. Confirm that the public cannot guess a private storage path.

• Detect type from file contents.
• Keep uploads outside executable directories.
• Serve protected files through an authorization check.

Keep resource limits explicit and make failure cleanup part of the example. Log enough context to diagnose the operation without recording passwords, private message bodies, or uploaded file contents.

Continue with secure PHP upload guide, image preview, and WebP thumbnails.

Reference: PHP file upload documentation.