File upload security risks in PHP - Step-by-Step Execution

Concept Flow - File upload security risks

User selects file

↓

File sent to server

↓

Server checks file type

↓

Save file

↓

Potential risks if unchecked

↓

Malware, Overwrite, DoS, etc.

This flow shows how a file upload moves from user to server, where checks decide if the file is safe to save or must be rejected to avoid risks.

Execution Sample

PHP

<?php
if ($_FILES['file']['error'] === UPLOAD_ERR_OK) {
  $type = mime_content_type($_FILES['file']['tmp_name']);
  if ($type === 'image/png') {
    move_uploaded_file($_FILES['file']['tmp_name'], 'uploads/' . basename($_FILES['file']['name']));
  } else {
    echo 'Invalid file type';
  }
}
?>

This PHP code checks if the uploaded file is a PNG image before saving it, rejecting other types.

Execution Table

Step	Action	Check/Evaluation	Result	Next Step
1	Receive file upload	Check $_FILES['file']['error']	UPLOAD_ERR_OK (0)	Proceed to type check
2	Check file MIME type	mime_content_type() returns 'image/png'	Type is 'image/png'	Move file to uploads/
3	Move uploaded file	move_uploaded_file() success	File saved in uploads/	End
4	If type not 'image/png'	mime_content_type() returns other	Invalid file type	Reject upload
5	If error not UPLOAD_ERR_OK	Error code not 0	Upload failed	Reject upload

💡 Execution stops when file is saved or rejected due to error or invalid type.

Variable Tracker

Variable	Start	After Step 1	After Step 2	After Step 3/4
$_FILES['file']['error']	undefined	0 (UPLOAD_ERR_OK)	0	0 or error code
$type	undefined	undefined	'image/png' or other	'image/png' or other
File saved?	No	No	No	Yes if valid type, No if invalid

Key Moments - 3 Insights

Why do we check the file MIME type instead of just the file extension?

Because file extensions can be changed easily by users, but MIME type gives a better indication of the actual file content. See execution_table step 2 where mime_content_type() is used.

What happens if we don't check the upload error code?

If we skip checking $_FILES['file']['error'], we might try to process a file that failed to upload, causing errors or security issues. See execution_table step 1 and 5.

Is saving the file immediately after checking MIME type enough to ensure security?

No, other checks like file size, scanning for malware, and renaming files to avoid overwriting are also important. This example shows only a basic check (execution_table step 3).

Visual Quiz - 3 Questions

Look at the execution table, what is the value of $type at Step 2 if the uploaded file is a PNG image?

A 'application/pdf'

B 'text/plain'

C 'image/png'

D undefined

💡 Hint

Check the 'Check file MIME type' row in execution_table where mime_content_type() returns 'image/png'.

At which step does the program reject the upload due to invalid file type?

A Step 1

B Step 4

C Step 2

D Step 3

💡 Hint

Look for the row where the result is 'Invalid file type' in execution_table.

If $_FILES['file']['error'] is not UPLOAD_ERR_OK, what happens according to the execution table?

A Upload is rejected

B File is saved anyway

C File type is checked

D File is renamed

💡 Hint

See step 5 in execution_table where error code is not 0 and upload is rejected.

Concept Snapshot

File upload security risks:
- Always check $_FILES['file']['error'] before processing.
- Verify file MIME type, not just extension.
- Reject files with invalid types or errors.
- Save files safely to avoid overwriting.
- Additional checks (size, malware scan) improve security.

Full Transcript

This visual execution trace shows how a PHP script handles file uploads securely. First, it checks if the upload succeeded by verifying the error code. Then it checks the file's MIME type to confirm it is a PNG image. If valid, the file is saved to the uploads folder. If not, the upload is rejected. Variables like $_FILES['file']['error'] and $type change during these steps. Key points include why MIME type checking is important and why error checking prevents problems. The quiz tests understanding of these steps and outcomes.

Practice

1. Which of the following is the most important reason to validate file types during a PHP file upload?

easy

A. To make the upload process faster

B. To allow uploading any file without restrictions

C. To reduce server storage space

D. To prevent users from uploading harmful scripts disguised as files

Solution

1. Step 1: Understand file upload risks

   Malicious users can upload harmful scripts if file types are not checked.

2. Step 2: Importance of validation

   Validating file types helps block dangerous files and protects the server.

3. Final Answer:

   To prevent users from uploading harmful scripts disguised as files -> Option D

4. Quick Check:

   File type validation = prevent harmful uploads [OK]

Hint: Always check file types to block dangerous uploads [OK]

Common Mistakes:

• Ignoring file type validation
• Assuming all files are safe
• Only checking file extensions without content

2. Which PHP function is commonly used to check the MIME type of an uploaded file for security?

easy

A. mime_content_type()

B. is_uploaded_file()

C. file_get_contents()

D. move_uploaded_file()

Solution

1. Step 1: Identify function purpose

   mime_content_type() returns the MIME type of a file, useful for validation.

2. Step 2: Compare with other functions

   move_uploaded_file() moves files, file_get_contents() reads content, is_uploaded_file() checks upload status.

3. Final Answer:

   mime_content_type() -> Option A

4. Quick Check:

   Check MIME type = mime_content_type() [OK]

Hint: Use mime_content_type() to verify file type safely [OK]

Common Mistakes:

• Using move_uploaded_file() to check file type
• Confusing file_get_contents() with type checking
• Not verifying MIME type at all

3. What will be the output of this PHP code snippet if a user uploads a file named image.jpg with size 5MB, but the allowed max size is 2MB?

$maxSize = 2 * 1024 * 1024; // 2MB
if ($_FILES['file']['size'] > $maxSize) {
    echo 'File too large';
} else {
    echo 'Upload successful';
}

medium

A. File too large

B. Upload successful

C. No output

D. Syntax error

Solution

1. Step 1: Understand size check logic

   The code compares uploaded file size to maxSize (2MB).

2. Step 2: Compare actual file size

   Uploaded file is 5MB, which is greater than 2MB, so condition is true.

3. Final Answer:

   File too large -> Option A

4. Quick Check:

   5MB > 2MB triggers 'File too large' [OK]

Hint: Compare file size with max allowed size [OK]

Common Mistakes:

• Confusing bytes and megabytes
• Not multiplying correctly for max size
• Ignoring file size check

4. Identify the security issue in this PHP file upload code snippet:

if (move_uploaded_file($_FILES['file']['tmp_name'], 'uploads/' . $_FILES['file']['name'])) {
    echo 'Upload successful';
} else {
    echo 'Upload failed';
}

medium

A. Using original filename without sanitization

B. All of the above

C. Missing check if file is uploaded via HTTP POST

D. No file size check before upload

Solution

1. Step 1: Check file size validation

   Code does not check file size before moving the file.

2. Step 2: Check filename handling

   Using original filename directly risks overwriting and security issues.

3. Step 3: Check upload method validation

   Missing is_uploaded_file() check to confirm HTTP POST upload.

4. Final Answer:

   All of the above -> Option B

5. Quick Check:

   Missing size, sanitization, and upload checks [OK]

Hint: Check size, sanitize name, verify upload method [OK]

Common Mistakes:

• Ignoring filename sanitization
• Not verifying upload method
• Skipping file size validation

5. You want to securely handle file uploads in PHP by allowing only PNG images under 1MB, renaming files to a unique name, and preventing script execution. Which combination of steps is best?

hard

A. Check file size, move file with original name, allow all image types

B. Only check file extension, rename file, save in uploads folder

C. Check MIME type with mime_content_type(), limit size, rename with uniqid(), save outside web root

D. Skip validation, rename file, save in web root

Solution

1. Step 1: Validate file type and size

   Use mime_content_type() to confirm PNG and check size under 1MB.

2. Step 2: Rename file and secure storage

   Rename with uniqid() to avoid conflicts and save outside web root to prevent script execution.

3. Final Answer:

   Check MIME type with mime_content_type(), limit size, rename with uniqid(), save outside web root -> Option C

4. Quick Check:

   Validate type & size + rename + secure storage [OK]

Hint: Validate type/size, rename uniquely, store securely [OK]

Common Mistakes:

• Relying only on file extension
• Saving files in web root without restrictions
• Not renaming files uniquely