PHP security checklist: 8 steps to find and fix vulnerabilities

File uploads become a security risk when attackers can upload executable files or access data they shouldn’t see. Check which file types and sizes your application accepts, where uploads are stored, and who can download them. Test upload and download routes for path traversal, make sure uploaded files cannot run as PHP, and check that .env, .git, and backup files aren’t publicly accessible.

Below is a PHP example that checks an uploaded file’s MIME type and saves it under a randomly generated name:

if (($_FILES['file']['error'] ?? null) !== UPLOAD_ERR_OK) {
    throw new RuntimeException('Upload failed');
}

$tmp = $_FILES['file']['tmp_name'];
$allowed = ['image/jpeg' => 'jpg', 'image/png' => 'png'];
$mime = (new finfo(FILEINFO_MIME_TYPE))->file($tmp);

if (!isset($allowed[$mime])) {
    throw new RuntimeException('Unsupported file type');
}

$name = bin2hex(random_bytes(16)) . '.' . $allowed[$mime];
$target = '/var/app/private-uploads/' . $name;

if (!move_uploaded_file($tmp, $target)) {
    throw new RuntimeException('Unable to save upload');
}

The example assumes a single file upload and an existing, private directory with appropriate permissions. PHP’s move_uploaded_file() confirms that the source was uploaded through PHP’s HTTP POST mechanism.

MIME checking alone isn’t enough to make uploads safe. Production code also needs server-enforced file-size limits, upload and download permissions, and validation of the actual file contents. Re-encode images where appropriate and consider malware scanning for higher-risk uploads. Keep files outside the web root where practical, restrict filesystem access, and prevent uploaded files from executing as PHP.