# PHP File Uploads

With PHP, it is easy to upload files to the server. However, with ease comes danger, so always be careful when allowing file uploads!

---

## 1. The HTML Form
To allow users to upload files, the `<form>` tag must use the `method="post"` and `enctype="multipart/form-data"` attributes.

```html
<form action="upload.php" method="post" enctype="multipart/form-data">
  Select image to upload:
  <input type="file" name="fileToUpload" id="fileToUpload">
  <input type="submit" value="Upload Image" name="submit">
</form>
```

## 2. The PHP Script
The uploaded file information is stored in the `$_FILES` superglobal.

```php
$target_dir = "uploads/";
$target_file = $target_dir . basename($_FILES["fileToUpload"]["name"]);

if (move_uploaded_file($_FILES["fileToUpload"]["tmp_name"], $target_file)) {
    echo "The file ". htmlspecialchars(basename($_FILES["fileToUpload"]["name"])). " has been uploaded.";
} else {
    echo "Sorry, there was an error uploading your file.";
}
```

## 3. The `$_FILES` Array
*   `$_FILES['file']['name']`: The original name of the file on the client machine.
*   `$_FILES['file']['type']`: The mime type of the file (e.g. "image/gif").
*   `$_FILES['file']['size']`: The size of the file in bytes.
*   `$_FILES['file']['tmp_name']`: The temporary filename of the file in which the uploaded file was stored on the server.
*   `$_FILES['file']['error']`: The error code associated with this file upload.

## 4. Basic Validation
Always validate uploads to ensure security.

```php
// Check if file already exists
if (file_exists($target_file)) {
  echo "Sorry, file already exists.";
  $uploadOk = 0;
}

// Check file size (e.g. limit to 500KB)
if ($_FILES["fileToUpload"]["size"] > 500000) {
  echo "Sorry, your file is too large.";
  $uploadOk = 0;
}
```

[[programming/php/php]] [[programming/php/php-forms]] [[programming/php/php-security]]