File Upload Security and MIME-Type Validation

A file form needs method="post" and enctype="multipart/form-data". PHP describes each parsed upload in $_FILES with name, tmp_name, error, size, and a browser-supplied type. move_uploaded_file() moves a recognized PHP upload from its temporary location to your chosen destination. Validate the shape of the supported single-file field; multiple-file forms can produce nested arrays. UPLOAD_ERR_OK is the success code. Other codes distinguish no selection, interruption, and server storage failures. If the entire request exceeds post_max_size, expected POST and FILES entries may be absent. Web servers and proxies also have body limits. Explain limits to users before submission, then enforce them again on the server. The HTML accept attribute only improves the picker; a custom client can ignore it completely.

Decide which formats your feature needs rather than accepting every type PHP can identify. A profile picture usually needs a small set of bitmap formats. Check upload errors first, then nonzero size and an application maximum. upload_max_filesize and post_max_size are additional boundaries, with the complete request needing room for multipart overhead. Avoid reading a huge file into memory to discover it is too large. Compressed images can expand into enormous pixel buffers, so decoding and thumbnail creation need dimension and memory limits. Use maintained processing libraries and limit total files, user storage, and upload frequency. An otherwise valid image can still fill the disk if uploads are unlimited. Keep error responses specific enough to help without revealing storage paths.

Use finfo with FILEINFO_MIME_TYPE on the temporary file, then compare its result with an allowlist mapping MIME types to application-chosen extensions. Neither $_FILES['type'] nor the original extension proves the actual format. Fileinfo uses signatures and classification rules; it is not a complete malware scanner or a guarantee that every parser can safely process the file. A stricter bitmap pipeline decodes and re-encodes the image under resource limits. SVG is active XML content with a different risk profile, so this example does not accept it. Select the response Content-Type from validated metadata when serving files. Avoid guessing types from names during downloads, particularly when files may be interpreted by a browser.

Choose a private directory outside the public document root and ensure the server cannot execute scripts there. Generate a filename using random_bytes() and an extension selected from your policy. This avoids traversal, attacker-chosen replacement names, and accidental collisions. Random names do not grant authorization: private downloads still require ownership or role checks. Store a generated name, owner, type, size, and internal identifier in a database. A controlled endpoint retrieves metadata, checks access, and reads the trusted path. The storage directory should be controlled by the application rather than writable by unrelated users. Check move_uploaded_file() before recording success. If metadata saving fails after the move, remove the specific file or track it for cleanup.

Escape original filenames when showing them in HTML; a filename can contain markup. Never use the original name as a filesystem path. A name such as portrait.jpg.php becomes especially dangerous in an executable public folder. Session-authenticated upload endpoints need CSRF protection, and access should match the account feature's rules. Documents may need malware scanning with availability delayed until checks finish. Audit the owner, time, size, type, and scan result without logging confidential contents. Download responses often use Content-Disposition: attachment and X-Content-Type-Options: nosniff. Deletion should take an internal file ID and use the stored generated name, rather than accepting a path. Treat missing files and abandoned metadata as recoverable cases with a cleanup process.

Prepare one small JPEG, one PNG, an empty file, an oversized file, and plain text renamed to look like an image. Check each against your declared policy and verify rejected uploads never become available. Send a malformed array-shaped field to test request-shape handling. In an isolated environment, make storage unwritable and confirm the response reports failure rather than successful upload. Verify another user's file cannot be downloaded or deleted, even with its internal ID. Also test request limits at the server and proxy layers because your handler may not run for an oversized body. Repeat processing tests with unusual dimensions rather than treating file size alone as a complete resource budget.

Extend the design for private receipts. Decide your permitted formats, save internal ID and owner alongside the generated filename, and create an authorized download endpoint. The solution accepts a file ID, queries metadata using a prepared statement, and checks the authenticated owner before streaming. Set Content-Type from validated metadata and choose an attachment disposition. Test a missing ID, another user's ID, an unsupported format, and metadata whose stored file disappeared. If scanning is part of the policy, keep files unavailable while their state is pending. Never trust the original upload name when reconstructing the storage path.

Assume receipts has id, owner_id, storage_name, mime_type, and scan_state columns. The authenticated owner ID comes from trusted session state, and the storage name was generated by the upload handler. The same private directory is used for saving and reading. Only a clean file becomes available. This route needs GET-method handling under the application's router; it performs no state change.

<?php
// $receiptId is a validated integer; $ownerId is trusted authentication state.
$stmt = $pdo->prepare(
    'SELECT storage_name, mime_type FROM receipts '
    . "WHERE id = ? AND owner_id = ? AND scan_state = 'clean'"
);
$stmt->execute([$receiptId, $ownerId]);
$row = $stmt->fetch(PDO::FETCH_ASSOC);
$types = ['image/jpeg', 'image/png', 'application/pdf'];
if ($row === false
    || !preg_match('/\A[a-f0-9]{32}\.(?:jpg|png|pdf)\z/', $row['storage_name'])
    || !in_array($row['mime_type'], $types, true)) {
    http_response_code(404); exit('Receipt unavailable.');
}
$path = dirname(__DIR__) . '/private-upload/' . $row['storage_name'];
$handle = fopen($path, 'rb');
if ($handle === false) {
    http_response_code(404); exit('Receipt unavailable.');
}
try {
    header('Content-Type: ' . $row['mime_type']);
    header('Content-Disposition: attachment; filename="receipt"');
    header('X-Content-Type-Options: nosniff');
    header('Cache-Control: no-store');
    fpassthru($handle);
} finally {
    fclose($handle);
}

Expected behavior: an authorized clean receipt streams as an attachment; another owner's receipt, a pending scan, and a missing record receive the same unavailable response. The private directory must be application-controlled. Configure warnings to log privately so a failed open cannot disclose its filesystem path. The download policy includes PDF as an extension of the task; the earlier bitmap upload handler still accepts only JPEG and PNG.

Read form validation, file handling, and security for the surrounding request and storage boundaries.

The PHP upload manual documents upload metadata and error codes.