File upload security risks in PHP - Step-by-Step Execution

Concept Flow - File upload security risks

User selects file

↓

File sent to server

↓

Server checks file type

↓

Save file

↓

Potential risks if unchecked

↓

Malware, Overwrite, DoS, etc.

This flow shows how a file upload moves from user to server, where checks decide if the file is safe to save or must be rejected to avoid risks.

Execution Sample

PHP

<?php
if ($_FILES['file']['error'] === UPLOAD_ERR_OK) {
  $type = mime_content_type($_FILES['file']['tmp_name']);
  if ($type === 'image/png') {
    move_uploaded_file($_FILES['file']['tmp_name'], 'uploads/' . basename($_FILES['file']['name']));
  } else {
    echo 'Invalid file type';
  }
}
?>

This PHP code checks if the uploaded file is a PNG image before saving it, rejecting other types.

Execution Table

Step	Action	Check/Evaluation	Result	Next Step
1	Receive file upload	Check $_FILES['file']['error']	UPLOAD_ERR_OK (0)	Proceed to type check
2	Check file MIME type	mime_content_type() returns 'image/png'	Type is 'image/png'	Move file to uploads/
3	Move uploaded file	move_uploaded_file() success	File saved in uploads/	End
4	If type not 'image/png'	mime_content_type() returns other	Invalid file type	Reject upload
5	If error not UPLOAD_ERR_OK	Error code not 0	Upload failed	Reject upload

💡 Execution stops when file is saved or rejected due to error or invalid type.

Variable Tracker

Variable	Start	After Step 1	After Step 2	After Step 3/4
$_FILES['file']['error']	undefined	0 (UPLOAD_ERR_OK)	0	0 or error code
$type	undefined	undefined	'image/png' or other	'image/png' or other
File saved?	No	No	No	Yes if valid type, No if invalid

Key Moments - 3 Insights

Why do we check the file MIME type instead of just the file extension?

Because file extensions can be changed easily by users, but MIME type gives a better indication of the actual file content. See execution_table step 2 where mime_content_type() is used.

What happens if we don't check the upload error code?

If we skip checking $_FILES['file']['error'], we might try to process a file that failed to upload, causing errors or security issues. See execution_table step 1 and 5.

Is saving the file immediately after checking MIME type enough to ensure security?

No, other checks like file size, scanning for malware, and renaming files to avoid overwriting are also important. This example shows only a basic check (execution_table step 3).

Visual Quiz - 3 Questions

Look at the execution table, what is the value of $type at Step 2 if the uploaded file is a PNG image?

A 'application/pdf'

B 'text/plain'

C 'image/png'

D undefined

💡 Hint

Check the 'Check file MIME type' row in execution_table where mime_content_type() returns 'image/png'.

At which step does the program reject the upload due to invalid file type?

A Step 1

B Step 4

C Step 2

D Step 3

💡 Hint

Look for the row where the result is 'Invalid file type' in execution_table.

If $_FILES['file']['error'] is not UPLOAD_ERR_OK, what happens according to the execution table?

A Upload is rejected

B File is saved anyway

C File type is checked

D File is renamed

💡 Hint

See step 5 in execution_table where error code is not 0 and upload is rejected.

Concept Snapshot

File upload security risks:
- Always check $_FILES['file']['error'] before processing.
- Verify file MIME type, not just extension.
- Reject files with invalid types or errors.
- Save files safely to avoid overwriting.
- Additional checks (size, malware scan) improve security.

Full Transcript

This visual execution trace shows how a PHP script handles file uploads securely. First, it checks if the upload succeeded by verifying the error code. Then it checks the file's MIME type to confirm it is a PNG image. If valid, the file is saved to the uploads folder. If not, the upload is rejected. Variables like $_FILES['file']['error'] and $type change during these steps. Key points include why MIME type checking is important and why error checking prevents problems. The quiz tests understanding of these steps and outcomes.