Image Upload in PHP: A Simple Guide

Images are widely used in websites and web applications. Users may need to upload profile photos, product images, documents, or other visual content.

PHP provides built-in support for handling uploaded files through the $_FILES superglobal. With a simple HTML form and server-side validation, developers can create an effective image upload feature.

Create an Image Upload Form

The HTML form should use multipart/form-data so the image can be sent to the server.

<form method="post" enctype="multipart/form-data">
    <input type="file" name="image">
    <button type="submit">Upload Image</button>
</form>

Handle the Uploaded Image

PHP provides uploaded file information through $_FILES.

if (isset($_FILES['image'])) {
    $imageName = $_FILES['image']['name'];
    $tmpName = $_FILES['image']['tmp_name'];

    move_uploaded_file(
        $tmpName,
        'uploads/' . $imageName
    );
}

The move_uploaded_file() function moves the uploaded file from its temporary location to the desired directory.

Validate the Image

Never accept uploaded files without validation.

Check important properties such as:

• File size
• File extension
• MIME type
• Upload errors

For example:

$allowed = ['jpg', 'jpeg', 'png', 'gif'];

$extension = strtolower(
    pathinfo($_FILES['image']['name'], PATHINFO_EXTENSION)
);

if (!in_array($extension, $allowed)) {
    die('Invalid image type.');
}

Generate a Safer Filename

Using the original filename can create conflicts or security problems.

A better approach is to generate a unique filename:

$filename = uniqid() . '.' . $extension;

move_uploaded_file(
    $_FILES['image']['tmp_name'],
    'uploads/' . $filename
);

This helps prevent filename collisions.

Limit Image Size

Large images can consume unnecessary storage and bandwidth.

Set a reasonable file-size limit before processing the upload:

if ($_FILES['image']['size'] > 2 * 1024 * 1024) {
    die('Image is too large.');
}

You can also resize images after uploading when your application does not require the original dimensions.

Security Best Practices

Image upload functionality should always include server-side validation.

Do not rely only on the file extension supplied by the user. Validate the actual file, restrict allowed formats, limit file sizes, generate safe filenames, and store uploads in a properly secured location.

For applications handling sensitive content, additional access controls may also be required.

Conclusion

Image upload in PHP is relatively simple to implement, but proper validation is essential. A reliable solution should combine a multipart form, PHP file handling, file-type validation, size restrictions, and safe filename generation.

By following these practices, developers can create an image-upload feature that is both functional and more secure.