PHP File Upload

With PHP, you can upload files to the server.

Create a file upload form

Allowing users to upload files from the form is very useful.

Please see the following HTML form for uploading files:

<html>
<body>
<form action="upload_file.php" method="post"
enctype="multipart/form-data">
<label for="file">Filename:</label>
<input type="file" name="file" id="file" /> 
<br />
<input type="submit" name="submit" value="Submit" />
</form>
</body>
</html>

Please note the following information about this form:

The enctype attribute of the <form> tag specifies which content type should be used when submitting the form. Use "multipart/form-data" when the form requires binary data, such as file content.

The type="file" attribute of the <input> tag specifies that the input should be treated as a file. For example, when previewing in a browser, you will see a browse button next to the input box.

Note:Allowing users to upload files is a huge security risk. Please only allow trusted users to perform file upload operations.

Create an upload script

"upload_file.php" file contains the code for uploading files:

<?php
if ($_FILES["file"]["error"] > 0)
  {
  echo "Error: " . $_FILES["file"]["error"] . "<br />";
  }
else
  {
  echo "Upload: " . $_FILES["file"]["name"] . "<br />";
  echo "Type: " . $_FILES["file"]["type"] . "<br />";
  echo "Size: " . ($_FILES["file"]["size"] / 1024) . " Kb<br />";
  echo "Stored in: " . $_FILES["file"]["tmp_name"];
  }
?>

By using PHP's global array $_FILES, you can upload files from the client computer to the remote server.

The first parameter is the form's input name, and the second index can be "name", "type", "size", "tmp_name", or "error". Like this:

  • $_FILES["file"]["name"] - Name of the uploaded file
  • $_FILES["file"]["type"] - Type of the uploaded file
  • $_FILES["file"]["size"] - Size of the uploaded file in bytes
  • $_FILES["file"]["tmp_name"] - Name of the temporary copy of the file stored on the server
  • $_FILES["file"]["error"] - Error code caused by file upload

This is a very simple way to upload files. For security considerations, you should add restrictions on what users are allowed to upload.

Upload restrictions

In this script, we have added restrictions on file uploads. Users can only upload .gif or .jpeg files, and the file size must be less than 20 kb:

<?php
if ((($_FILES["file"]["type"] == "image/gif")
|| ($_FILES["file"]["type"] == "image/jpeg")
|| ($_FILES["file"]["type"] == "image/pjpeg"))
&& ($_FILES["file"]["size"] < 20000))
  {
  if ($_FILES["file"]["error"] > 0)
    {
    echo "Error: " . $_FILES["file"]["error"] . "<br />";
    }
  else
    {
    echo "Upload: " . $_FILES["file"]["name"] . "<br />";
    echo "Type: " . $_FILES["file"]["type"] . "<br />";
    echo "Size: " . ($_FILES["file"]["size"] / 1024) . " Kb<br />";
    echo "Stored in: " . $_FILES["file"]["tmp_name"];
    }
  }
else
  {
  echo "Invalid file";
  }
?>

Note:For IE, the type of jpg file must be pjpeg, for FireFox, it must be jpeg.

Save the uploaded file

The example above created a temporary copy of the uploaded file in the PHP temporary folder on the server.

This temporary copy of the file will disappear at the end of the script. To save the uploaded file, we need to copy it to another location:

<?php
if ((($_FILES["file"]["type"] == "image/gif")
|| ($_FILES["file"]["type"] == "image/jpeg")
|| ($_FILES["file"]["type"] == "image/pjpeg"))
&& ($_FILES["file"]["size"] < 20000))
  {
  if ($_FILES["file"]["error"] > 0)
    {
    echo "Return Code: " . $_FILES["file"]["error"] . "<br />";
    }
  else
    {
    echo "Upload: " . $_FILES["file"]["name"] . "<br />";
    echo "Type: " . $_FILES["file"]["type"] . "<br />";
    echo "Size: " . ($_FILES["file"]["size"] / 1024) . " Kb<br />";
    echo "Temp file: " . $_FILES["file"]["tmp_name"] . "<br />";
    if (file_exists("upload/" . $_FILES["file"]["name"]))
      {
      echo $_FILES["file"]["name"] . " already exists. ";
      }
    else
      {
      move_uploaded_file($_FILES["file"]["tmp_name"],
      "upload/" . $_FILES["file"]["name"]);
      echo "Stored in: " . "upload/" . $_FILES["file"]["name"];
      }
    }
  }
else
  {
  echo "Invalid file";
  }
?>

The script above checks if the file already exists. If it does not exist, it copies the file to the specified folder.

Note:This example saves the file to a new folder named "upload".