PHP File Upload security

Question

I have a script that upload files to my server here is my code

When a user uploads a file to the server

1. My script renames the file and save the details in db.

2. I place files outside of web root.

so is my approach safe?

Answer 1

You should do further input validation on your file, like:

• check the file size

• check the file type with a "File Type Recogniser"

• check content header

You can also check best practices for file uploads here: https://www.owasp.org/index.php/Unrestricted_File_Upload

Never run the file on your server.

to check content type (i've never done this myself btw) you can try soemthing like:

$file = "path2file";
$finfo = new finfo(FILEINFO_MIME);
$type = $finfo->file($file);
if(in_array($type,array("application/zip", "application/x-zip", .. whatever content types are ok...)))
  //you passed