File upload security risks in PHP - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is a common security risk when allowing file uploads in PHP?

Uploading malicious files that can execute harmful code on the server, such as PHP scripts disguised as images.

beginner

Why should you validate the file type during upload?

To ensure only allowed file types are accepted, preventing attackers from uploading dangerous files like executable scripts.

intermediate

What is the risk of not limiting file size in uploads?

Attackers can upload very large files to exhaust server storage or cause denial of service by overloading resources.

intermediate

How can storing uploaded files outside the web root improve security?

It prevents direct access to uploaded files via URL, reducing the chance of executing malicious files on the server.

beginner

What is the purpose of renaming uploaded files?

Renaming files avoids overwriting existing files and prevents attackers from guessing file locations or executing scripts by name.

Which of the following is a key risk when accepting file uploads in PHP?

A Uploading a file smaller than 1KB

B Uploading a text file with no content

C Uploading a PHP script disguised as an image

D Uploading a file with a .txt extension

Malicious PHP scripts disguised as images can run harmful code on the server if not properly checked.

What is a good practice to prevent execution of uploaded files?

A Allow all file types

B Disable file size limits

C Use the original file name

D Store files outside the web root directory

Storing files outside the web root prevents direct access and execution via URL.

Why should you check the MIME type of an uploaded file?

A To verify the file is of an allowed type

B To increase upload speed

C To reduce file size

D To rename the file automatically

Checking MIME type helps confirm the file content matches allowed types, improving security.

What can happen if you do not limit the size of uploaded files?

A Server storage can be exhausted

B Files will upload faster

C Files will be automatically deleted

D Users can upload only images

Large files can fill server storage and cause denial of service.

Renaming uploaded files helps to:

A Make files larger

B Prevent overwriting and guessing file paths

C Allow execution of scripts

D Disable file uploads

Renaming files avoids conflicts and hides original file names from attackers.

Explain the main security risks involved with file uploads in PHP and how to mitigate them.

Think about how attackers might use file uploads to harm the server.

Describe best practices to securely handle file uploads in a PHP application.

Focus on steps that reduce risk of malicious files and server overload.