Secure File Upload: Validating Types, Checking Size, and Preventing Upload Vulnerabilities

File upload functionality is common in web applications but is also a frequent attack vector; attackers can exploit it to upload malicious files that compromise servers, leak data, or spread malware, so strict filtering and validation of uploaded files are essential.

1. Validate File Type – Attackers may rename a harmless file (e.g., .txt ) to a script (e.g., .php ) and execute it. By checking the MIME type against an allowed list, only expected file types are accepted.

function checkFileType($file)
{
    $allowedTypes = array('image/jpeg', 'image/png', 'image/gif');

    if (in_array($file['type'], $allowedTypes)) {
        return true;
    }
    return false;
}

// Check the uploaded file
if (isset($_FILES['file'])) {
    if (checkFileType($_FILES['file'])) {
        // File type is valid, continue processing
    } else {
        // File type is invalid, throw an error or handle accordingly
    }
}

2. Check File Size – Large files can exhaust storage or cause crashes. Setting a maximum size (e.g., 1 MB) and rejecting oversized uploads mitigates this risk.

function checkFileSize($file)
{
    $maxSize = 1024 * 1024; // Limit size to 1 MB

    if ($file['size'] <= $maxSize) {
        return true;
    }
    return false;
}

// Check the uploaded file
if (isset($_FILES['file'])) {
    if (checkFileSize($_FILES['file'])) {
        // File size is valid, continue processing
    } else {
        // File size is invalid, throw an error or handle accordingly
    }
}

3. Prevent File‑Upload Vulnerabilities – Beyond type and size checks, store uploads in a non‑web‑accessible directory, generate random filenames, and set restrictive permissions to prevent direct execution of malicious code.

function saveUploadedFile($file)
{
    $uploadDir = '/path/to/uploads/';
    $filename = uniqid() . '_' . $file['name'];
    $targetFile = $uploadDir . $filename;

    // Save the uploaded file to the designated directory
    if (move_uploaded_file($file['tmp_name'], $targetFile)) {
        // File saved successfully, continue processing
    } else {
        // File saving failed, throw an error or handle accordingly
    }
}

// Check the uploaded file
if (isset($_FILES['file'])) {
    if (checkFileType($_FILES['file']) && checkFileSize($_FILES['file'])) {
        saveUploadedFile($_FILES['file']);
    } else {
        // File type or size is invalid, throw an error or handle accordingly
    }
}

Conclusion – By rigorously filtering uploaded files—validating their type, limiting their size, storing them securely, using random names, and applying proper permissions—developers can effectively mitigate file‑upload vulnerabilities and maintain the ongoing security of web applications.