当前位置：首页 > PHP

php 实现文件上传

2026-03-13 03:49:58PHP

文件上传基础实现

创建一个包含文件上传表单的HTML页面，表单需设置enctype="multipart/form-data"属性：

<form action="upload.php" method="post" enctype="multipart/form-data">
    <input type="file" name="fileToUpload">
    <input type="submit" value="Upload">
</form>

处理上传的PHP脚本

在upload.php中处理上传逻辑，检查文件是否存在错误并移动到目标目录：

$targetDir = "uploads/";
$targetFile = $targetDir . basename($_FILES["fileToUpload"]["name"]);
$uploadOk = 1;

if ($_FILES["fileToUpload"]["error"] !== UPLOAD_ERR_OK) {
    $uploadOk = 0;
}

if ($uploadOk && move_uploaded_file($_FILES["fileToUpload"]["tmp_name"], $targetFile)) {
    echo "File uploaded successfully.";
} else {
    echo "Error uploading file.";
}

安全增强措施

验证文件类型和大小，防止恶意文件上传：

$allowedTypes = ["image/jpeg", "image/png"];
$maxSize = 2 * 1024 * 1024; // 2MB

if (!in_array($_FILES["fileToUpload"]["type"], $allowedTypes)) {
    $uploadOk = 0;
}

if ($_FILES["fileToUpload"]["size"] > $maxSize) {
    $uploadOk = 0;
}

文件重命名策略

为避免文件名冲突，生成唯一文件名：

$fileExtension = pathinfo($_FILES["fileToUpload"]["name"], PATHINFO_EXTENSION);
$newFileName = uniqid() . '.' . $fileExtension;
$targetFile = $targetDir . $newFileName;

错误处理与反馈

提供详细的错误反馈帮助用户理解问题：

if ($_FILES["fileToUpload"]["error"] !== UPLOAD_ERR_OK) {
    switch ($_FILES["fileToUpload"]["error"]) {
        case UPLOAD_ERR_INI_SIZE:
            echo "File exceeds server limit.";
            break;
        case UPLOAD_ERR_FORM_SIZE:
            echo "File exceeds form limit.";
            break;
        // 其他错误情况...
    }
}

完整示例代码

结合所有安全措施的完整上传处理脚本：

php 实现文件上传

$targetDir = "uploads/";
$allowedTypes = ["image/jpeg", "image/png"];
$maxSize = 2 * 1024 * 1024;

if ($_FILES["fileToUpload"]["error"] !== UPLOAD_ERR_OK) {
    die("Upload error occurred.");
}

if (!in_array($_FILES["fileToUpload"]["type"], $allowedTypes)) {
    die("Invalid file type.");
}

if ($_FILES["fileToUpload"]["size"] > $maxSize) {
    die("File too large.");
}

$fileExtension = strtolower(pathinfo($_FILES["fileToUpload"]["name"], PATHINFO_EXTENSION));
$newFileName = uniqid() . '.' . $fileExtension;
$targetFile = $targetDir . $newFileName;

if (move_uploaded_file($_FILES["fileToUpload"]["tmp_name"], $targetFile)) {
    echo "Upload successful. File saved as: " . htmlspecialchars($newFileName);
} else {
    echo "Error saving file.";
}