PHP $_FILES Array

The $_FILES superglobal is an associative array that stores information about files uploaded through HTTP POST requests in PHP.

• File Name: The original name of the uploaded file.
• File Size: The size of the uploaded file in bytes.
• File Type: The MIME type reported by the browser.
• Temporary Name: The temporary path where PHP stores the uploaded file.
• Upload Error: The error code associated with the upload.

PHP Stores Uploaded File Information in the $_FILES Array

PHP organizes uploaded file information using the name of the HTML file input field.

Syntax:

$_FILES['input_name']['attribute'];

Common attributes include:

For example, if the file input has name="photo", its information can be accessed using $_FILES['photo']['name'], $_FILES['photo']['size'], and other attributes.

PHP Displays Uploaded File Information Using $_FILES

The following example displays the contents of the $_FILES array before and after a file is uploaded.

Example:

<?php
echo "<pre>";
print_r($_FILES);
echo "</pre>";
?>

Before uploading a file:

Array
(
)

After uploading a file:

Array
(
    [photo] => Array
        (
            [name] => example.jpg
            [type] => image/jpeg
            [tmp_name] => /tmp/phpXXXXXX
            [error] => 0
            [size] => 102400
        )
)

Note: The temporary path and file details vary depending on the uploaded file and server configuration.

PHP Receives Uploaded Files Through an HTML Form

To upload a file, an HTML form must use the POST method and the multipart/form-data encoding type.

Example: index.html

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>PHP File Upload</title>
</head>
<body>
    <h2>Upload a File</h2>

    <form action="file-upload-manager.php"
          method="post"
          enctype="multipart/form-data">

        <input type="file" name="photo" required>
        <button type="submit">Upload</button>

    </form>
</body>
</html>

• method="post" sends the form data through an HTTP POST request.
• enctype="multipart/form-data" enables file uploads.
• name="photo" identifies the uploaded file in the PHP $_FILES array.
• The action attribute specifies the PHP script that processes the upload.

PHP Accesses File Details Using the $_FILES Array

The PHP script can access the uploaded file's name, type, size, temporary path, and error code through $_FILES.

Example: file-upload-manager.php

<?php
if ($_SERVER['REQUEST_METHOD'] === 'POST') {

    if (!isset($_FILES['photo'])) {
        exit("No file was submitted.");
    }

    $file = $_FILES['photo'];

    if ($file['error'] !== UPLOAD_ERR_OK) {
        exit("File upload failed. Error code: " . $file['error']);
    }

    $file_name = $file['name'];
    $file_type = $file['type'];
    $file_size = $file['size'];
    $file_tmp_name = $file['tmp_name'];
    $file_error = $file['error'];

    echo "File Name: " .
        htmlspecialchars($file_name, ENT_QUOTES, 'UTF-8') . "<br>";

    echo "File Type: " .
        htmlspecialchars($file_type, ENT_QUOTES, 'UTF-8') . "<br>";

    echo "File Size: " . $file_size . " bytes<br>";

    echo "File Error: " . $file_error . "<br>";

    echo "Temporary Name: " .
        htmlspecialchars($file_tmp_name, ENT_QUOTES, 'UTF-8');
}
?>

Output:

File Name: example.jpg
File Type: image/jpeg
File Size: 102400 bytes
File Error: 0
Temporary Name: /tmp/phpXXXXXX

• $_SERVER['REQUEST_METHOD'] checks whether the request uses POST.
• $_FILES['photo'] retrieves the information associated with the uploaded file.
• The error attribute checks whether the upload succeeded. UPLOAD_ERR_OK indicates success.
• The name, type, size, and tmp_name attributes provide the file's details.
• htmlspecialchars() escapes special HTML characters before displaying text values.

Note: This example displays uploaded file information but does not permanently save the file. PHP stores uploaded files temporarily, so use move_uploaded_file() to move a successfully uploaded file to a destination when permanent storage is required.

PHP Requires File Validation Before Processing Uploads

The $_FILES array provides file metadata, but the submitted values should not be treated as trustworthy.

• Validate File Types: Check the actual file content using tools such as PHP's finfo_file() instead of relying only on the browser-provided MIME type.
• Restrict File Size: Enforce an application-level size limit and configure PHP's upload limits appropriately.
• Check Upload Errors: Verify that the error attribute equals UPLOAD_ERR_OK.
• Use Safe File Names: Generate a server-side file name instead of trusting the original file name.
• Store Files Safely: Save uploaded files in an appropriate location and avoid executing untrusted uploads.

These checks help protect PHP applications against invalid uploads and malicious files.