PHP File Upload Explained with Examples (Beginner Guide 2026)
Introduction
Almost every modern website allows users to upload files. Whether it’s a profile picture, resume, product image, PDF document, or assignment, PHP provides a simple and secure way to handle file uploads.
Using the $_FILES superglobal, PHP can receive uploaded files, validate them, and store them on the server.
In this guide, you’ll learn how to upload files safely using PHP.
What is File Upload in PHP?
File upload is the process of sending a file from a user’s computer to a web server.
Common examples include:
- Profile pictures
- Product images
- PDF documents
- Resume uploads
- Assignment submissions
- Gallery images
- Company logos
HTML Upload Form
To upload a file, the form must use the multipart/form-data encoding.
<form action="upload.php"
method="POST"
enctype="multipart/form-data">
<label>Select Image</label>
<input type="file"
name="image">
<input type="submit"
value="Upload">
</form>
Without enctype="multipart/form-data", file uploads will not work.
Understanding $_FILES
When a file is uploaded, PHP stores its information inside the $_FILES array.
Example:
<?php
print_r($_FILES);
?>
Typical output includes:
- File name
- File type
- Temporary location
- File size
- Upload error code
Uploading a File
<?php
$fileName = $_FILES["image"]["name"];
$tempName = $_FILES["image"]["tmp_name"];
move_uploaded_file(
$tempName,
"uploads/" . $fileName
);
echo "Upload Successful";
?>
The uploaded file is moved from the temporary folder to the uploads directory.
Restrict File Size
Prevent users from uploading very large files.
<?php
if($_FILES["image"]["size"] > 2097152){
echo "Maximum 2MB allowed.";
exit;
}
?>
Here, 2097152 bytes equals 2 MB.
Allow Only Images
Check the file extension before uploading.
<?php
$extension = strtolower(
pathinfo(
$_FILES["image"]["name"],
PATHINFO_EXTENSION
)
);
$allowed = ["jpg","jpeg","png","webp"];
if(!in_array($extension,$allowed)){
echo "Invalid File Type.";
exit;
}
?>
Rename Uploaded Files
Avoid duplicate filenames.
<?php
$newName = time() . "." . $extension;
move_uploaded_file(
$_FILES["image"]["tmp_name"],
"uploads/" . $newName
);
?>
Using timestamps creates unique file names.
Real-World Example
Suppose a user uploads a profile picture.
Steps:
- User selects an image.
- PHP validates the size.
- PHP checks the extension.
- PHP renames the file.
- PHP stores the image in
/uploads. - File path is saved in the database.
This is how most websites handle profile images.
Common Upload Errors
Common issues include:
- File too large
- Invalid file type
- Upload folder missing
- No file selected
- File permissions incorrect
Always display meaningful error messages to users.
Security Tips
- Validate file type.
- Restrict maximum file size.
- Rename uploaded files.
- Never trust the original filename.
- Store uploads outside the public root when possible.
- Scan uploaded files if handling sensitive systems.
Best Practices
- Create a dedicated
uploadsfolder. - Give proper folder permissions.
- Allow only required file types.
- Limit upload size.
- Display upload success or failure messages.
- Save file paths in the database instead of binary data when appropriate.
Frequently Asked Questions
Can PHP upload videos?
Yes. Increase PHP upload limits and validate the file type.
Where are uploaded files stored first?
PHP stores them in a temporary directory before you move them using move_uploaded_file().
Can users upload multiple files?
Yes. By using the multiple attribute in the HTML input and processing the array in $_FILES.
Conclusion
PHP file uploads are an essential feature for modern web applications. By validating file types, restricting file sizes, renaming files, and following security best practices, you can safely allow users to upload images, documents, and other files.
Mastering file uploads is an important step toward building professional PHP applications.
Next Tutorial
PHP MySQL Connection Explained (2026 Guide)