How to Upload a File in PHP With Example

The enctype attribute specifies the type of encoding which should be used when the form is submitted and it takes one of the following three values:

• application/x-www-form-urlencoded: This is the default value when you don’t set the value of the enctype attribute explicitly. In this case, characters are encoded before it’s sent to server. If you don’t have the file field in your form, you should use this value for the enctype attribute.
• multipart/form-data: When you use the multipart/form-data value for the enctype attribute, it allows you to upload files using the POST method. Also, it makes sure that the characters are not encoded when the form is submitted.
• text/plain: This is generally not used. With this setting, the data is sent unencoded.

Next, we output the file field which allows you to select a file from your computer.

Apart from that, we’ve displayed a message at the top of the form. This message shows the status of the file upload and it’ll be set in a session variable by the upload.php script. We’ll look more at this in the next section.

%s', $_SESSION['message']);
      unset($_SESSION['message']);
    }
?>

So, that sums up the index.php file. In the next section, we’ll see how to handle the uploaded file at the server side.

Create the Upload Logic

In the previous section, we created the HTML form which is displayed on the client side and allows you to upload a file from your computer. In this section, we’ll see the server-side counterpart which allows you to handle the uploaded file.

Pull in the code from the upload.php file at GitHub. We’ll go through the important parts of that file.

In the upload.php file, we’ve checked that if it’s a valid POST request in the first place.

if (isset($_POST['uploadBtn']) && $_POST['uploadBtn'] == 'Upload') {
...
}

In PHP, when a file is uploaded, the $_FILES superglobal variable is populated with all the information about the uploaded file. It’s initialized as an array and may contain the following information for the successful file-upload.

• tmp_name: The temporary path where the file is uploaded is stored in this variable.
• name: The actual name of the file is stored in this variable.
• size: Indicates the size of the uploaded file in bytes.
• type: Contains the mime type of the uploaded file.
• error: If there’s any error during file-upload, this variable is populated with the appropriate error message. In the case of successful file-upload, it contains 0 which you can compare by using for the UPLOAD_ERR_OK constant.

After validating the POST request, we check that the file upload was successful.

if (isset($_FILES['uploadedFile']) && $_FILES['uploadedFile']['error'] === UPLOAD_ERR_OK) {
...
}

You can see that the $_FILES variable is a multi-dimensional array, the first element is the name of the file field and the second element has the information about the uploaded file as we’ve just discussed above.

If the file upload is successful, we initialize a few variables with information about the uploaded file.

// get details of the uploaded file
$fileTmpPath = $_FILES['uploadedFile']['tmp_name'];
$fileName = $_FILES['uploadedFile']['name'];
$fileSize = $_FILES['uploadedFile']['size'];
$fileType = $_FILES['uploadedFile']['type'];
$fileNameCmps = explode(".", $fileName);
$fileExtension = strtolower(end($fileNameCmps));

In the above snippet, we’ve also figured out the extension of the uploaded file and stored it in the $fileExtension variable.

As the uploaded file may contain spaces and other special characters, it’s better to sanitize the filename and that’s exactly we’ve done in the following snippet.

$newFileName = md5(time() . $fileName) . '.' . $fileExtension;

It’s important that you restrict the type of file which can be uploaded to certain extensions and don’t allow everything using the upload form. We’ve done that by checking the extension of the uploaded file with a set of extensions that we want to allow for uploading.

$allowedfileExtensions = array('jpg', 'gif', 'png', 'zip', 'txt', 'xls', 'doc');
if (in_array($fileExtension, $allowedfileExtensions)) {
...
}

Finally, we use the move_uploaded_file function to move the uploaded file to the specific location of our choice.

// directory in which the uploaded file will be moved
$uploadFileDir = './uploaded_files/';
$dest_path = $uploadFileDir . $newFileName;

if(move_uploaded_file($fileTmpPath, $dest_path))
{
  $message ='File is successfully uploaded.';
}
else
{
  $message = 'There was some error moving the file to upload directory. Please make sure the upload directory is writable by web server.';
}

The move_uploaded_file function takes two arguments. The first argument is the filename of the uploaded file and the second argument is the destination path where you want to move the file.

Finally, we redirect the user to the index.php file. Also, we set the appropriate message in the session variable which will be displayed to users after redirection in the index.php file.

How It All Works Together

Don’t forget to create the uploaded_files directory and make  writable by the web-server user. Next, go ahead and run the index.php file which should display the file upload form which looks like this:

Click on the Browse button—that should open a dialog box which allows you to select a file from your computer. Select a file with one of the extensions allowed in our script and click on the Upload button.

That should submit the form and if everything goes well, you should see the uploaded file in the uploaded_files directory. You could also try uploading other files with extensions that are not allowed and check if our script prevents such uploads.

Conclusion

Today, we discussed the basics of file upload in PHP. In the first half of the article, we discussed the different configuration options that need to be in place for file upload to work. Then we looked at a real-world example which demonstrated how file upload works in PHP.

I hope you’ve enjoyed this article, feel free to post your queries and suggestions below!