PHP File Upload – Simple and Secure Guide with Code Example

Create an HTML Form

<form action="upload.php" method="POST" enctype="multipart/form-data">
    <label for="file">Choose a file:</label>
    <input type="file" name="file" id="file">
    <input type="submit" value="Upload File">
</form>

enctype="multipart/form-data" is required for file uploads.
The input element with type="file" allows users to select a file.

Handle File Upload in PHP (upload.php)

if ($_SERVER["REQUEST_METHOD"] === "POST") {
    $targetDir = "uploads/"; // Directory to store the uploaded file
    $fileName = basename($_FILES["file"]["name"]);
    $targetFilePath = $targetDir . $fileName;
    $fileType = strtolower(pathinfo($targetFilePath, PATHINFO_EXTENSION));

    // Allowed file types
    $allowedTypes = array("jpg", "png", "jpeg", "gif", "pdf");

    // Validate file type
    if (in_array($fileType, $allowedTypes)) {
        // Check for file upload errors
        if ($_FILES["file"]["error"] === UPLOAD_ERR_OK) {
            // Move the file to the target directory
            if (move_uploaded_file($_FILES["file"]["tmp_name"], $targetFilePath)) {
                echo "File uploaded successfully: $fileName";
            } else {
                echo "Error uploading file.";
            }
        } else {
            echo "Error during file upload.";
        }
    } else {
        echo "Invalid file type. Only JPG, PNG, JPEG, GIF, and PDF files are allowed.";
    }
}

Create the "uploads" Directory

In the root of your project, create a folder called uploads.
Set the write permissions so that PHP can save the uploaded files.

File Upload Validation

Allow only specific file types (e.g., JPG, PNG, PDF)
Limit file size (e.g., max 2MB)
Protect against file overwriting

Add File Size Restriction (Optional)

$maxFileSize = 2 * 1024 * 1024; // 2 MB

if ($_FILES["file"]["size"] > $maxFileSize) {
    echo "File size exceeds the 2MB limit.";
}

Complete PHP File Upload Code

<?php
if ($_SERVER["REQUEST_METHOD"] === "POST") {
    $targetDir = "uploads/";
    $fileName = basename($_FILES["file"]["name"]);
    $targetFilePath = $targetDir . $fileName;
    $fileType = strtolower(pathinfo($targetFilePath, PATHINFO_EXTENSION));
    $allowedTypes = array("jpg", "png", "jpeg", "gif", "pdf");
    $maxFileSize = 2 * 1024 * 1024; // 2 MB

    if (in_array($fileType, $allowedTypes)) {
        if ($_FILES["file"]["size"] <= $maxFileSize) {
            if ($_FILES["file"]["error"] === UPLOAD_ERR_OK) {
                if (move_uploaded_file($_FILES["file"]["tmp_name"], $targetFilePath)) {
                    echo "File uploaded successfully: $fileName";
                } else {
                    echo "Error uploading file.";
                }
            } else {
                echo "Error during file upload.";
            }
        } else {
            echo "File size exceeds the 2MB limit.";
        }
    } else {
        echo "Invalid file type. Only JPG, PNG, JPEG, GIF, and PDF files are allowed.";
    }
}
?>

Output Example

File uploaded successfully: example.jpg
Invalid file type
File size exceeds the limit

Best Practices for PHP File Upload

Sanitize file names to prevent security vulnerabilities
Restrict file types and size
Use unique file names to avoid overwriting