PHP File Upload Handling Validation Move

Ringkasan

Upload file ditangani via $_FILES, divalidasi, lalu dipindah ke folder tujuan dengan move_uploaded_file().

Konsep Dasar

• $_FILES['file'] berisi name, type, size, tmp_name, error.
• Cek $_FILES['file']['error'] === UPLOAD_ERR_OK.
• Validasi ekstensi & MIME, batasi ukuran (upload_max_filesize).
• move_uploaded_file($tmp, $dest) — hanya file dari upload tmp yang boleh.

Cara Kerja / Struktur

php

if ($_FILES['file']['error'] === UPLOAD_ERR_OK) {
    $tmp = $_FILES['file']['tmp_name'];
    $name = basename($_FILES['file']['name']);
    if (in_array(mime_content_type($tmp), ['image/png','image/jpeg'])) {
        move_uploaded_file($tmp, "uploads/$name");
    }
}

Catatan Implementasi

• Jangan percaya type dari client — cek mime_content_type().
• Generate nama unik (bin2hex(random_bytes(8))) cegah overwrite & path traversal.
• Folder uploads/ jangan executable script.

Kesalahan Umum

• Pakai name langsung tanpa basename() → path traversal.
• Lupa cek error → file gagal tapi dianggap sukses.

Glosarium

• tmp_name: path file sementara hasil upload.
• Path traversal: manipulasi path untuk akses file terlarang.

Referensi

• PHP Keamanan Dasar