当前位置：首页 > PHP

php实现上传实例

2026-02-14 00:31:30PHP

PHP 文件上传基础实现

创建一个简单的文件上传表单，使用 enctype="multipart/form-data" 确保文件数据正确传输：

<form action="upload.php" method="post" enctype="multipart/form-data">
    <input type="file" name="fileToUpload" id="fileToUpload">
    <input type="submit" value="Upload File" name="submit">
</form>

处理上传的 PHP 脚本（upload.php）核心代码：

$targetDir = "uploads/";
$targetFile = $targetDir . basename($_FILES["fileToUpload"]["name"]);

if (move_uploaded_file($_FILES["fileToUpload"]["tmp_name"], $targetFile)) {
    echo "The file ". htmlspecialchars(basename($_FILES["fileToUpload"]["name"])). " has been uploaded.";
} else {
    echo "Sorry, there was an error uploading your file.";
}

安全增强措施

设置文件大小限制，防止过大文件上传：

$maxFileSize = 500000; // 500KB
if ($_FILES["fileToUpload"]["size"] > $maxFileSize) {
    die("File is too large.");
}

限制允许的文件类型，只接受图片：

$allowedTypes = ["jpg", "png", "jpeg", "gif"];
$fileExtension = strtolower(pathinfo($targetFile, PATHINFO_EXTENSION));

if (!in_array($fileExtension, $allowedTypes)) {
    die("Only JPG, JPEG, PNG & GIF files are allowed.");
}

文件重命名处理

生成唯一文件名防止覆盖和注入攻击：

$newFileName = uniqid() . '.' . $fileExtension;
$targetFile = $targetDir . $newFileName;

完整示例代码

结合所有安全检查的完整处理脚本：

$targetDir = "uploads/";
$maxFileSize = 500000;
$allowedTypes = ["jpg", "png", "jpeg", "gif"];

if(isset($_POST["submit"])) {
    $fileExtension = strtolower(pathinfo($_FILES["fileToUpload"]["name"], PATHINFO_EXTENSION));
    $newFileName = uniqid() . '.' . $fileExtension;
    $targetFile = $targetDir . $newFileName;

    // 检查文件类型
    if (!in_array($fileExtension, $allowedTypes)) {
        die("Error: Only image files are allowed.");
    }

    // 检查文件大小
    if ($_FILES["fileToUpload"]["size"] > $maxFileSize) {
        die("Error: File is too large.");
    }

    // 移动临时文件到目标位置
    if (move_uploaded_file($_FILES["fileToUpload"]["tmp_name"], $targetFile)) {
        echo "The file has been uploaded as " . htmlspecialchars($newFileName);
    } else {
        echo "Error: There was an error uploading your file.";
    }
}

高级安全处理

添加图像验证确保上传的是真实图片：

$check = getimagesize($_FILES["fileToUpload"]["tmp_name"]);
if($check === false) {
    die("Error: File is not an actual image.");
}

设置更严格的权限：

chmod($targetFile, 0644); // 设置文件权限为所有者可读写，其他只读

错误处理机制

完善错误捕获和处理：

if ($_FILES["fileToUpload"]["error"] !== UPLOAD_ERR_OK) {
    switch($_FILES["fileToUpload"]["error"]) {
        case UPLOAD_ERR_INI_SIZE:
            die("Error: File exceeds server size limit.");
        case UPLOAD_ERR_FORM_SIZE:
            die("Error: File exceeds form size limit.");
        // 其他错误情况处理...
        default:
            die("Error: Unknown upload error.");
    }
}

php实现上传实例