File upload security risks in PHP - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to check if the uploaded file is an image.

PHP

<?php
if(isset($_FILES['file'])) {
    $check = getimagesize($_FILES['file']['[1]']);
    if($check !== false) {
        echo "File is an image.";
    } else {
        echo "File is not an image.";
    }
}
?>

Drag options to blanks, or click blank then click option'

Atype

Bname

Ctmp_name

Dsize

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'name' instead of 'tmp_name' causes getimagesize to fail.

Checking 'type' is not reliable for security.

The getimagesize() function requires the temporary file path, which is stored in tmp_name.

2fill in blank

medium

Complete the code to allow only files with .jpg extension.

PHP

<?php
$filename = $_FILES['file']['name'];
$ext = strtolower(pathinfo($filename, PATHINFO_[1]));
if($ext === 'jpg') {
    echo "File extension allowed.";
} else {
    echo "File extension not allowed.";
}
?>

Drag options to blanks, or click blank then click option'

AEXT

BEXTENSION

CEXTNAME

DEXTENSION_NAME

Attempts:

3 left

💡 Hint

Common Mistakes

Using incorrect constant names causes errors.

Not converting extension to lowercase can cause mismatches.

The correct constant for getting the file extension is PATHINFO_EXT.

3fill in blank

hard

Fix the error in the code to prevent overwriting files by renaming the uploaded file.

PHP

<?php
$uploadDir = 'uploads/';
$filename = $_FILES['file']['name'];
$newName = $uploadDir . time() . '_' . [1];
move_uploaded_file($_FILES['file']['tmp_name'], $newName);
?>

Drag options to blanks, or click blank then click option'

Afilename

B$filename

C$_FILES['file']['name']

Dfile_name

Attempts:

3 left

💡 Hint

Common Mistakes

Using undefined variables causes errors.

Forgetting the $ sign before variable names.

Use the variable $filename to append the original file name safely.

4fill in blank

hard

Fill both blanks to check file size and reject files larger than 2MB.

PHP

<?php
if($_FILES['file']['[1]'] > [2]) {
    echo "File is too large.";
} else {
    echo "File size is acceptable.";
}
?>

Drag options to blanks, or click blank then click option'

Asize

B2000000

Ctmp_name

D5000000

Attempts:

3 left

💡 Hint

Common Mistakes

Checking 'tmp_name' instead of 'size'.

Using too large or too small size limits.

The file size is stored in size and 2MB equals 2,000,000 bytes approximately.

5fill in blank

hard

Fill all three blanks to safely move the uploaded file with a unique name and check for errors.

PHP

<?php
if($_FILES['file']['error'] === [1]) {
    $uploadDir = 'uploads/';
    $uniqueName = uniqid('', true) . '.' . pathinfo($_FILES['file']['name'], PATHINFO_[2]);
    $destination = $uploadDir . $uniqueName;
    if(move_uploaded_file($_FILES['file']['[3]'], $destination)) {
        echo "File uploaded successfully.";
    } else {
        echo "Failed to move uploaded file.";
    }
} else {
    echo "Upload error.";
}
?>

Drag options to blanks, or click blank then click option'

A0

BEXT

Ctmp_name

D1

Attempts:

3 left

💡 Hint

Common Mistakes

Using wrong error codes.

Using wrong keys for file path or extension.

Upload error code 0 means no error. Use PATHINFO_EXT to get the extension and 'tmp_name' for the temporary file path.

Practice

1. Which of the following is the most important reason to validate file types during a PHP file upload?

easy

A. To make the upload process faster

B. To allow uploading any file without restrictions

C. To reduce server storage space

D. To prevent users from uploading harmful scripts disguised as files

Solution

1. Step 1: Understand file upload risks

   Malicious users can upload harmful scripts if file types are not checked.

2. Step 2: Importance of validation

   Validating file types helps block dangerous files and protects the server.

3. Final Answer:

   To prevent users from uploading harmful scripts disguised as files -> Option D

4. Quick Check:

   File type validation = prevent harmful uploads [OK]

Hint: Always check file types to block dangerous uploads [OK]

Common Mistakes:

• Ignoring file type validation
• Assuming all files are safe
• Only checking file extensions without content

2. Which PHP function is commonly used to check the MIME type of an uploaded file for security?

easy

A. mime_content_type()

B. is_uploaded_file()

C. file_get_contents()

D. move_uploaded_file()

Solution

1. Step 1: Identify function purpose

   mime_content_type() returns the MIME type of a file, useful for validation.

2. Step 2: Compare with other functions

   move_uploaded_file() moves files, file_get_contents() reads content, is_uploaded_file() checks upload status.

3. Final Answer:

   mime_content_type() -> Option A

4. Quick Check:

   Check MIME type = mime_content_type() [OK]

Hint: Use mime_content_type() to verify file type safely [OK]

Common Mistakes:

• Using move_uploaded_file() to check file type
• Confusing file_get_contents() with type checking
• Not verifying MIME type at all

3. What will be the output of this PHP code snippet if a user uploads a file named image.jpg with size 5MB, but the allowed max size is 2MB?

$maxSize = 2 * 1024 * 1024; // 2MB
if ($_FILES['file']['size'] > $maxSize) {
    echo 'File too large';
} else {
    echo 'Upload successful';
}

medium

A. File too large

B. Upload successful

C. No output

D. Syntax error

Solution

1. Step 1: Understand size check logic

   The code compares uploaded file size to maxSize (2MB).

2. Step 2: Compare actual file size

   Uploaded file is 5MB, which is greater than 2MB, so condition is true.

3. Final Answer:

   File too large -> Option A

4. Quick Check:

   5MB > 2MB triggers 'File too large' [OK]

Hint: Compare file size with max allowed size [OK]

Common Mistakes:

• Confusing bytes and megabytes
• Not multiplying correctly for max size
• Ignoring file size check

4. Identify the security issue in this PHP file upload code snippet:

if (move_uploaded_file($_FILES['file']['tmp_name'], 'uploads/' . $_FILES['file']['name'])) {
    echo 'Upload successful';
} else {
    echo 'Upload failed';
}

medium

A. Using original filename without sanitization

B. All of the above

C. Missing check if file is uploaded via HTTP POST

D. No file size check before upload

Solution

1. Step 1: Check file size validation

   Code does not check file size before moving the file.

2. Step 2: Check filename handling

   Using original filename directly risks overwriting and security issues.

3. Step 3: Check upload method validation

   Missing is_uploaded_file() check to confirm HTTP POST upload.

4. Final Answer:

   All of the above -> Option B

5. Quick Check:

   Missing size, sanitization, and upload checks [OK]

Hint: Check size, sanitize name, verify upload method [OK]

Common Mistakes:

• Ignoring filename sanitization
• Not verifying upload method
• Skipping file size validation

5. You want to securely handle file uploads in PHP by allowing only PNG images under 1MB, renaming files to a unique name, and preventing script execution. Which combination of steps is best?

hard

A. Check file size, move file with original name, allow all image types

B. Only check file extension, rename file, save in uploads folder

C. Check MIME type with mime_content_type(), limit size, rename with uniqid(), save outside web root

D. Skip validation, rename file, save in web root

Solution

1. Step 1: Validate file type and size

   Use mime_content_type() to confirm PNG and check size under 1MB.

2. Step 2: Rename file and secure storage

   Rename with uniqid() to avoid conflicts and save outside web root to prevent script execution.

3. Final Answer:

   Check MIME type with mime_content_type(), limit size, rename with uniqid(), save outside web root -> Option C

4. Quick Check:

   Validate type & size + rename + secure storage [OK]

Hint: Validate type/size, rename uniquely, store securely [OK]

Common Mistakes:

• Relying only on file extension
• Saving files in web root without restrictions
• Not renaming files uniquely