Jinsi ya Kutumia move_uploaded_file kwa Secure Uploads

move_uploaded_file() ni function ya PHP inayohamisha uploaded file kutoka temporary location ($_FILES['tmp_name']) kwenda folder unalotaka.

Usalama muhimu:

Hakikisha file ni halali na inakidhi requirements zako.

Zuia malicious files (PHP scripts, executables) kupakiwa.

Tumia unique filenames na secure directories.

⚙️ 2. Basic Usage ya move_uploaded_file()
<?php
if(isset($_FILES['uploaded_file'])){
$target_dir = "uploads/";

if(!is_dir($target_dir)){
mkdir($target_dir, 0755, true);
}

$original_name = basename($_FILES['uploaded_file']['name']);
$target_file = $target_dir . time() . "_" . $original_name;

if(move_uploaded_file($_FILES['uploaded_file']['tmp_name'], $target_file)){
echo "✅ File uploaded successfully: <a href='$target_file' target='_blank'>View File</a>";
} else {
echo "❌ Error uploading file.";
}
}
?>


$_FILES['uploaded_file']['tmp_name'] ni temporary location.

Unique name = time() . "_" . $original_name inazuia overwriting.

🧩 3. Adding Security Checks
<?php
$allowed_types = ['jpg','jpeg','png','gif','pdf'];
$file_type = strtolower(pathinfo($original_name, PATHINFO_EXTENSION));
$max_size = 5 * 1024 * 1024; // 5MB

// Validate type
if(!in_array($file_type, $allowed_types)){
die("❌ Error: Only JPG, PNG, GIF, PDF allowed.");
}

// Validate size
if($_FILES['uploaded_file']['size'] > $max_size){
die("❌ Error: File too large. Max 5MB allowed.");
}

// Move file securely
if(move_uploaded_file($_FILES['uploaded_file']['tmp_name'], $target_file)){
echo "✅ Secure upload successful.";
} else {
echo "❌ Error uploading file.";
}


💡 Maelezo:

Validate type na size kabla ya move_uploaded_file.

Avoid uploading .php scripts kwenye web root.

🔑 4. Vidokezo vya Usalama Zaidi

Store files outside web root – use folder inaccessible directly via URL.

Rename files – avoid original names to prevent execution or overwrite.

Set folder permissions properly – usually 0755 suffices.

Avoid executing uploaded files – disable script execution in upload folder (.htaccess).

Scan files – optionally, use antivirus or mime-type checking.

✅ 5. Hitimisho

move_uploaded_file() ni salama ikiwa unafanya validation, renaming, secure storage.

Combine na authentication & CSRF protection kwa security zaidi.

Best practices: validate file type & size, use unique names, secure directory, avoid PHP scripts upload.

🔗 Tembelea:

👉 https://www.faulink.com/

Kwa mafunzo zaidi ya PHP, file uploads, na secure web application practices.