PHP file upload Script :: online picture upload

if (isset($_FILES['file']) && $_FILES['file']['error'] === UPLOAD_ERR_OK) {
    $tmp = $_FILES['file']['tmp_name'];
    $finfo = new finfo(FILEINFO_MIME_TYPE);
    $allowed = ['image/jpeg' => 'jpg', 'image/png' => 'png'];
    $mime = $finfo->file($tmp);
    if (isset($allowed[$mime]) && $_FILES['file']['size'] <= 2 * 1024 * 1024) {
        $name = bin2hex(random_bytes(16)) . '.' . $allowed[$mime];
        move_uploaded_file($tmp, __DIR__ . '/uploads/' . $name);
    }
}

upload.php

<form ACTION='uploadck.php' METHOD=POST  enctype='multipart/form-data' >
Upload this file: <input type=file name='file_up'>
<input type=submit value='Upload Image'></FORM>

uploadck.php

• Check the PHP upload error and file size.
• Detect the MIME type from the temporary file with finfo and compare it with an allowlist.
• Generate a server-side filename and store the upload with move_uploaded_file() in a non-executable upload directory.

foreach($_FILES['file_up'] as $key => $val) {
echo htmlspecialchars(strval($key), ENT_QUOTES, 'UTF-8') . ' -> ' . htmlspecialchars(strval($val), ENT_QUOTES, 'UTF-8') . '<br>';
}

$_FILES['file_up'];

$_FILES['file_up']['size']

$file = $_FILES['file_up'] ?? null;
if (is_array($file)) {
    echo 'File size: ' . intval($file['size'] ?? 0) . ' bytes<br>';
    echo 'Upload error: ' . intval($file['error'] ?? UPLOAD_ERR_NO_FILE);
}

Maximum allowed file upload size.

<?Php
echo "Maximum allowed file size: ".ini_get('upload_max_filesize');
echo "<br>";
echo "Maximum input time : ".ini_get('max_input_time');
echo "<br>";
echo "Maximum execution time : ".ini_get('max_execution_time');
echo "<br>";
echo "Maximum Post size : ".ini_get('post_max_size');
?>

if (($_FILES['file_up']['size'] ?? 0) > 250000) {
    $msg = 'The uploaded file is larger than 250 KB.';
}

<form action='uploadck.php' method=post  enctype='multipart/form-data' >
Upload this file: <input type=file name='file_up'>
<input type=submit value='Upload Image'></FORM>

<?php
$file = $_FILES['file_up'] ?? null;
if (!is_array($file) || ($file['error'] ?? UPLOAD_ERR_NO_FILE) !== UPLOAD_ERR_OK) {
    exit('Upload failed');
}
if (($file['size'] ?? 0) > 250000) {
    exit('File is larger than 250 KB');
}
$tmp = $file['tmp_name'] ?? '';
if (!is_uploaded_file($tmp)) {
    exit('Invalid upload');
}
$finfo = new finfo(FILEINFO_MIME_TYPE);
$allowed = ['image/jpeg' => 'jpg', 'image/png' => 'png'];
$mime = $finfo->file($tmp);
if (!isset($allowed[$mime])) {
    exit('Unsupported file type');
}
$name = bin2hex(random_bytes(16)) . '.' . $allowed[$mime];
$destination = __DIR__ . '/upload/' . $name;
if (!move_uploaded_file($tmp, $destination)) {
    exit('Could not store upload');
}
echo 'File successfully uploaded';
?>

Subhendu Mohapatra

Author & Instructor at plus2net

I write and maintain practical tutorials on Python, PHP, SQL, JavaScript, HTML, jQuery, and web development at plus2net. The tutorials focus on clear explanations, working examples, and code that readers can test and adapt while learning.

About the author   Watch on YouTube

Connect: