PHPでファイルアップロードを処理する方法は？

First, set up an HTML form with enctype="multipart/form-data" and method="post", then access the file via $_FILES in PHP, validate its type, size, and error status, move it securely using move_uploaded_file(), and follow security practices like storing outside web root and using random filenames.

Handling file uploads in PHP involves processing files sent from an HTML form, validating them, and securely storing them on the server. Here’s how to do it properly and safely.

Set up the HTML form

To allow file uploads, your HTML form must include the enctype="multipart/form-data" attribute and use the POST method.

Example:

Access the uploaded file in PHP

When a file is uploaded, PHP stores it temporarily and provides access via the $_FILES superglobal array. This array contains key details like name, type, size, tmp_name, and error.

In your upload.php file:

Validate and move the file

Never trust user input. Always validate the file before moving it to a permanent location.

• Check for upload errors using $fileError === UPLOAD_ERR_OK
• Verify file size (e.g., limit to 2MB)
• Check allowed file types by extension or MIME type
• Use move_uploaded_file() to move from temporary to desired directory

Example validation and move:

Security best practices

File uploads are a common attack vector. Follow these tips:

• Store uploaded files outside the web root when possible
• Use random filenames to prevent overwrites and path traversal
• Avoid executing uploaded files (e.g., don’t allow .php uploads)
• Verify file content using functions like getimagesize() for images
• Set proper permissions on upload directories

Basically, handle file uploads with care—validate everything and never assume the file is safe.

以上がPHPでファイルアップロードを処理する方法は？の詳細内容です。詳細については、PHP 中国語 Web サイトの他の関連記事を参照してください。