Securing PHP File Uploads: A Practical Guide to Preventing RCE

Why Basic File Uploads are Dangerous

Most PHP developers start handling file uploads using the basic move_uploaded_file() function. While this moves the file from the temporary directory to your storage folder, it does nothing to protect your server. If a user uploads a file named backdoor.php but hides it with a .jpg extension, your server might still execute it if configured incorrectly. This leads to Remote Code Execution (RCE), where an attacker gains full control over your web application.

Step 1: Validate the Upload Status

Before checking the file content, you must ensure the upload was successful and within the expected parameters. Always check the error key in the $_FILES superglobal. Do not assume the file exists just because the request was sent.

if (!isset($_FILES['upfile']['error']) || is_array($_FILES['upfile']['error'])) {
    throw new RuntimeException('Invalid parameters.');
}

switch ($_FILES['upfile']['error']) {
    case UPLOAD_ERR_OK:
        break;
    case UPLOAD_ERR_INI_SIZE:
    case UPLOAD_ERR_FORM_SIZE:
        throw new RuntimeException('Exceeded filesize limit.');
    default:
        throw new RuntimeException('Unknown errors.');
}

Step 2: Verify MIME Types, Not Extensions

Hackers can easily rename a .php file to .png. Relying on the file extension is a massive security flaw. Instead, use the finfo extension to check the actual byte content of the file to determine its true MIME type.

$finfo = new finfo(FILEINFO_MIME_TYPE);
$mimeType = $finfo->file($_FILES['upfile']['tmp_name']);

$allowedTypes = [
    'jpg' => 'image/jpeg',
    'png' => 'image/png',
    'pdf' => 'application/pdf'
];

$ext = array_search($mimeType, $allowedTypes, true);
if (false === $ext) {
    throw new RuntimeException('Invalid file format.');
}

Step 3: Obfuscate Filenames

Never keep the original filename provided by the user. Attackers use specific filenames to exploit directory traversal vulnerabilities or to overwrite existing system files. Generate a unique, random string using random_bytes() or sha1_file() to rename the file before saving.

$safeName = sprintf('%s.%s',
    sha1_file($_FILES['upfile']['tmp_name']),
    $ext
);

if (!move_uploaded_file($_FILES['upfile']['tmp_name'], __DIR__ . '/uploads/' . $safeName)) {
    throw new RuntimeException('Failed to move uploaded file.');
}

Step 4: Secure the Upload Directory

Even with validation, you should treat the upload directory as a "dead zone." If possible, store uploaded files outside of your public_html or www root. If you must store them within a public folder, use an .htaccess file (on Apache) to disable script execution in that specific directory:

# Inside /uploads/.htaccess
php_flag engine off
AddHandler cgi-script .php .phtml .php3 .pl .py .jsp .asp .htm .html .sh .cgi
Options -ExecCGI

Final Thoughts

Security is about layers. By validating the upload error, verifying the internal MIME type, renaming the file to a random hash, and restricting directory permissions, you create a robust defense against common web vulnerabilities. Always keep your PHP version updated to benefit from the latest security patches in file handling libraries.