To prevent PHP file upload vulnerabilities, you must first strictly control the uploaded content. 1. Always verify file types on the server side, use finfo_file() or mime_content_type() to check the real MIME type, and establish a whitelisting mechanism; 2. Do not trust user input and refuse to rely solely on front-end verification; 3. Rename the file after uploading, and use randomly generated file names to avoid execution risks; 4. Set correct directory permissions and prohibit script execution, such as restricting file type access through .htaccess; 5. Try to store files in non-public directories and provide access services through scripts; 6. Regularly scan uploaded content, strip away image EXIF ??data or use ImageMagick to reprocess images to clear potential malicious code.

The best way to prevent file upload vulnerabilities in PHP is by controlling what gets uploaded — not just assuming users will play nice. A lot of security issues start when you let people send files directly to your server without checking the type, content, or how it's handled.

Always validate file types on the server side

Client-side checks like JavaScript can be easily bypassed, so never rely on them alone. On the server side, don't just check the file extension — attackers can rename malicious files to look like images or PDFs. Instead, inspect the actual file MIME type using finfo_file() or similar functions.

Even that's not perfect though — some malicious files can fake their MIME type. So better yet: create a whitelist of allowed extensions and MIME types, and reject anything that doesn't match exactly.

Some things to do:

• Use mime_content_type() or finfo_open() to verify the real file type
• Compare against a list of allowed types (eg, only allow 'image/jpeg' , 'image/png' )
• Don't trust user input — always re-check everything server-side

Rename uploaded files

Letting users keep their original filenames opens the door for overwriting existing files or even uploading executable scripts with names like shell.php . To avoid this, always rename files to something random or generated by your system.

For example, use a function to generate a unique name like md5(uniqid()) . '.jpg' — this way, there's no guesswork for an attacker trying to access uploaded files directly.

Also, make sure you're storing uploads outside of web-accessible directories if possible, or at least restrict execution in that folder via .htaccess or server config.

Set proper directory permissions

Where you store uploaded files matters a lot. The upload directory should not allow script execution. In Apache, you can block execution using .htaccess :

 <FilesMatch "\.(php|pl|py|jsp|asp|sh|cgi)$">
    Order Deny, Allow
    Deny from all
</FilesMatch>

Also, make sure the upload folder has correct permissions — usually 755 is safe. Never give write permission to everyone ( 777 ) unless absolutely necessary, and even then, reconsider.

A few more tips:

• Store uploads in a non-public directory and serve them through a script
• Avoid letting users directly access the uploaded files
• Regularly scan uploaded content if dealing with sensitive environments

Scan for malicious content

It's easy to forget, but even a valid image file can contain embedded malware. Some attackers hide code inside image metadata or unused sections of the file. While PHP itself won't execute these by default, other tools or libraries might.

Use antivirus scanning if you're handling critical systems, or run basic checks like striping EXIF ??data from images using functions like exif_read_data() and saving a clean version.

You can also use tools like ImageMagick to re-process images — this often removes any hidden payloads.

That's basically it. It's not rocket science, but it requires attention to detail. Most file upload issues come from taking shortcuts or trusting the wrong layer (like front-end validation). Do the basics right, and you'll close most attack vectors.

The above is the detailed content of How do I prevent file upload vulnerabilities in PHP?. For more information, please follow other related articles on the PHP Chinese website!