is_uploaded_file

Tells whether the file was uploaded via HTTP POST (PHP 4 >= 4.0.3, PHP 5)
bool is_uploaded_file ( string filename )

Returns TRUE if the file named by filename was uploaded via HTTP POST. This is useful to help ensure that a malicious user hasn't tried to trick the script into working on files upon which it should not be working--for instance, /etc/passwd.

This sort of check is especially important if there is any chance that anything done with uploaded files could reveal their contents to the user, or even to other users on the same system.

For proper working, the function is_uploaded_file() needs an argument like $_FILES['userfile']['tmp_name'], - the name of the uploaded file on the clients machine $_FILES['userfile']['name'] does not work.

Parameters

filename: The filename being checked.

Return Values

Returns TRUE on success or FALSE on failure.

Examples

Example 657. is_uploaded_file() example

copy to clipboard

<?php

if (is_uploaded_file($_FILES['userfile']['tmp_name'])) {

   echo "File ". $_FILES['userfile']['name'] ." uploaded successfully.\n";

   echo "Displaying contents\n";

   readfile($_FILES['userfile']['tmp_name']);

} else {

   echo "Possible file upload attack: ";

   echo "filename '". $_FILES['userfile']['tmp_name'] . "'.";

}

?>

Example 658. is_uploaded_file() example for PHP 4 < 4.0.3

The following example will not work in versions of PHP 4 after 4.0.2. It depends on internal functionality of PHP which changed after that version.

copy to clipboard

<?php
/* Userland test for uploaded file. */
function is_uploaded_file_4_0_2($filename)

{

    if (!$tmp_file = get_cfg_var('upload_tmp_dir')) {

        $tmp_file = dirname(tempnam('', ''));

    }

    $tmp_file .= '/' . basename($filename);

    /* User might have trailing slash in php.ini... */

    return (ereg_replace('/+', '/', $tmp_file) == $filename);

}

/* This is how to use it, since you also don't have

 * move_uploaded_file() in these older versions: */
if (is_uploaded_file_4_0_2($HTTP_POST_FILES['userfile'])) {

    copy($HTTP_POST_FILES['userfile'], "/place/to/put/uploaded/file");

} else {

    echo "Possible file upload attack: filename '$HTTP_POST_FILES[userfile]'.";

}
?>

See Also

move_uploaded_file()

See Handling file uploadsfor a simple usage example.

Related Examples ( Source code ) » is_uploaded_file

Code Examples / Notes » is_uploaded_file

The description in the manual above says that the function needs an argument like: <?php $_FILES['userfile']['tmp_name'] ?> Which is incorrect! This variable returns the pathname of the temp file (with random filename) that is created by php and, besides, is a superglobal so there is no way that it is overridden to point to another file (by injection when register_globals is on for example). Which means that: <?php is_uploaded_file($_FILES['userfile']['tmp_name']); ?> MUST always evaluate to true by definition which is, of course, useless. The function is to be used only with variables that are prone to injection, which should not happen anyway since everyone should have their register globals off (finally we get rid of that in PHP6). Only $_FILES['userfile']['name'] contains user submitted string and should be sanitized if it's to be used as a filename because it could (could it?) contain relative or absolute path or undesirable filename. The former is done simply with: <?php $filename = basename($_FILES['userfile']['name']); ?>

Regarding topcat's suggested change, I am split on doing that. I don't like showing users errors that may give them more information than they should have (or show that I haven't provided for that particular error). But I want to know when there are errors that fall to the default case so I can fix my code. What I will typically do is write them to the error log something like this modification to metaltoad's post (takes into account the possibility of multi-line errors which error_log doesn't handle well): <?php default: //a default error, just in case! :) echo "There was a problem with your upload."; $err_msg = "Unrecognized file POST error: ".$HTTP_POST_FILES['userfile']['error']; if ((strpos($err_msg, "\n") === 0) { $err_lines = explode("\n", $err_msg); foreach ($err_lines as $msg) { error_log($msg, 0); } } else { error_log($err_msg, 0) } break; ?>

As of PHP 4.2.0, rather than automatically assuming a failed file uploaded is a file attack, you can use the error code associated with the file upload to check and see why the upload failed. This error code is stored in the userfile array (ex: $HTTP_POST_FILES['userfile']['error']). Here's an example of a switch: if (is_uploaded_file($userfile)) { //include code to copy tmp file to final location here... }else{ switch($HTTP_POST_FILES['userfile']['error']){ case 0: //no error; possible file attack! echo "There was a problem with your upload."; break; case 1: //uploaded file exceeds the upload_max_filesize directive in php.ini echo "The file you are trying to upload is too big."; break; case 2: //uploaded file exceeds the MAX_FILE_SIZE directive that was specified in the html form echo "The file you are trying to upload is too big."; break; case 3: //uploaded file was only partially uploaded echo "The file you are trying upload was only partially uploaded."; break; case 4: //no file was uploaded echo "You must select an image for upload."; break; default: //a default error, just in case! :) echo "There was a problem with your upload."; break; } Additionally, by testing the 'name' element of the file upload array, you can filter out unwanted file types (.exe, .zip, .bat, etc). Here's an example of a filter that can be added before testing to see if the file was uploaded: //rejects all .exe, .com, .bat, .zip, .doc and .txt files if(preg_match("/.exe$|.com$|.bat$|.zip$|.doc$|.txt$/i", $HTTP_POST_FILES['userfile']['name'])){ exit("You cannot upload this type of file."); } //if file is not rejected by the filter, continue normally if (is_uploaded_file($userfile)) { /*rest of code*/

<FORM ENCTYPE="multipart/form-data" ACTION="_URL_" METHOD=POST> Upload this file: <INPUT NAME="userfile" TYPE="file"> <INPUT TYPE="submit" VALUE="Send File"></FORM> This html code will display a text area with file upload button. The form tag is bit different than the normal form tag used ( see the encrypte =). Now let us go to the php part to handle the uploaded file. We have In PHP 3, the following variables will be defined within the destination script upon a successful upload, assuming that register_globals is turned on in php3.ini. If track_vars is turned on, they will also be available in PHP 3 within the global array $HTTP_POST_VARS. Note that the following variable names assume the use of the file upload name 'userfile', as used in the example above: * $userfile - The temporary filename in which the uploaded file was stored on the server machine. * $userfile_name - The original name or path of the file on the sender's system. * $userfile_size - The size of the uploaded file in bytes. * $userfile_type - The mime type of the file if the browser provided this information. An example would be "image/gif". With all these info we will make our script ready to handle the files. Let us check the file size and we will not allow file size more than 250 KB to get uploaded to our server. Here we are using a flag $file_upload to false for processing the file upload. if ($userfile_size >250000){$msg=$msg."Your uploaded file size is more than 250KB so please reduce the file size and then upload. Visit the help page to know how to reduce the file size. "; $file_upload="false";} Now let us check the file extension and only jpg or gif file pictures we will allow into our server. We will check this by using $userfile_type extension if (!($userfile_type =="image/pjpeg" OR $userfile_type=="image/gif")){$msg=$msg."Your uploaded file must be of JPG or GIF. Other file types are not allowed "; $file_upload="false";} We will limit ourselves to these two type checks and if we find our $file_upload variable is not "false" then we can upload the file. This part is very simple in PHP and can be done in one step. Before that let us decide the file directory name where we will be placing the file. $add is the path with the file name relative to the script running this code where the uploaded file will be stored. $add="upload/$userfile_name"; // the path with the file name where the file will be stored, upload is the directory name. Now let us copy the file to server. The command move_uploaded_file will does that job for us and if the action is successful then it will return true. if(move_uploaded_file ($userfile, $add)){ // do your coding here to give a thanks message or any other thing. }else{echo "Failed to upload file Contact Site admin to fix the problem";} Thats all... the file is placed in our directory (name: upload)

is_uploaded_file

Tells whether the file was uploaded via HTTP POST (PHP 4 >= 4.0.3, PHP 5) bool is_uploaded_file ( string filename )

Parameters

Return Values

Examples

Example 657. is_uploaded_file() example

Example 658. is_uploaded_file() example for PHP 4 < 4.0.3

Related Examples ( Source code ) » is_uploaded_file

Code Examples / Notes » is_uploaded_file

Change Language

Tells whether the file was uploaded via HTTP POST (PHP 4 >= 4.0.3, PHP 5)
bool is_uploaded_file ( string filename )