move_uploaded_file

(PHP 4 >= 4.0.3, PHP 5)

move_uploaded_file — Перемещает загруженный файл в новое место

Описание

bool move_uploaded_file ( string $filename , string $destination )

Эта функция проверяет, является ли файл filename загруженным на сервер (переданным по протоколу HTTP POST). Если файл действительно загружен на сервер, он будет перемещён в место, указанное в аргументе destination .

Если filename не является загруженным файлов, никаких действий не предпринимается и move_uploaded_file() возвращает FALSE.

Если filename является загруженным файлом, но не может быть перемещён по каким-либо причинам, никакие действия не предпринимаются и move_uploaded_file() возвращает FALSE. Кроме того, отображается предупреждение.

Такая проверка особенно важна в том случае, если существует шанс того, что какие-либо действия, производимые над загруженным файлом, могут открыть его содержимое пользователю или даже другим пользователям системы.

Замечание: На move_uploaded_file() не распространяются нормальные UID-ограничения режима безопасный режим. Это не является нарушением безопасности, потому что move_uploaded_file() оперирует лишь теми файлами, которые загружены на сервер через PHP. Функция move_uploaded_file() принимает во внимание как безопасный режим, так и open_basedir. Тем не менее, ограничения накладываются лишь на параметр destination , чтобы разрешить перемещение загруженных файлов, так как параметр filename может конфликтовать с этими ограничениями. move_uploaded_file() гарантирует безопасность этой операции, работая лишь с теми файлами, которые были загружены через PHP.

Внимание

Если файл destination уже существует, он будет перезаписан.

См. также описание функции is_uploaded_file() и раздел Загрузка файлов на сервер для примеров использования этих функций.

Коментарии

It seems that move_uploaded_file use the GROUP permissions of the parent directory of the tmp file location, whereas a simple "copy" uses the group of the apache process. This could create a security nighmare if your tmp file location is owned by root:wheel
2005-10-20 00:10:48
http://php5.kiev.ua/manual/ru/function.move-uploaded-file.html
Автор:
nouncad at mayetlite dot com posted a function that uploaded a file, and would rename it if it already existed, to filename[n].ext

It only worked for files with extensions exactly three letters long, so I fixed that (and made a few other improvements while I was at it).

<?php
// Usage: uploadfile($_FILE['file']['name'],'temp/',$_FILE['file']['tmp_name'])
function uploadfile($origin$dest$tmp_name)
{
 
$origin strtolower(basename($origin));
 
$fulldest $dest.$origin;
 
$filename $origin;
  for (
$i=1file_exists($fulldest); $i++)
  {
   
$fileext = (strpos($origin,'.')===false?'':'.'.substr(strrchr($origin"."), 1));
   
$filename substr($origin0strlen($origin)-strlen($fileext)).'['.$i.']'.$fileext;
   
$fulldest $dest.$newfilename;
  }
 
  if (
move_uploaded_file($tmp_name$fulldest))
    return 
$filename;
  return 
false;
}
?>
2006-04-13 21:12:07
http://php5.kiev.ua/manual/ru/function.move-uploaded-file.html
Автор:
Apparently the warning above might better be written "If the destination file already exists, it will be overwritten ... regardless of the destination file's permissions."

In other words, move_uploaded_file() executes as if it's root, not the user under which the web server is operating or the owner of the script that's executing.
2006-08-22 21:18:49
http://php5.kiev.ua/manual/ru/function.move-uploaded-file.html
If you're dealing with files uploaded through some external FTP source and need to move them to a final destination, searching php.net for "mv" or "move" won't get you what you want. You want the rename() function. 

function.rename

(move_uploaded_file() won't work, since the POST vars won't be present.)
2006-09-10 03:28:21
http://php5.kiev.ua/manual/ru/function.move-uploaded-file.html
Автор:
If you have a directory in a *nix environment where you store all of your file uploads and your php script only seems to work when permissions for that directory are set to 777, here's how to fix it so that you can have the security benefits of 755 while still allowing your php scripts to work, including the move_uploaded_file().

through shell access, navigate to the directory that contains your uploads folder and run the following 2 commands:
chown -R nobody uploaddir
chmod -R 755 uploaddir

Replace 'uploaddir' with the name of your uploads directory. The first command changes the owner of the directory and files to 'nobody' which is what php operates under. The second changes the folder and files to only allow user access to writing. This is much more secure.

Hopefully this will help someone out there who had the same problem as me.
2007-06-10 16:58:18
http://php5.kiev.ua/manual/ru/function.move-uploaded-file.html
Just a helpful comment.  If you have open_basedir set then you must set upload_tmp_dir to somewhere within the open_basedir.  Otherwise the file upload will be denied.  move_uploaded_file might be open_basedir aware, but the rest of the upload process isn't.
2007-07-16 14:29:55
http://php5.kiev.ua/manual/ru/function.move-uploaded-file.html
move_uploaded_file (on my setup) always makes files 0600 ("rw- --- ---") and owned by the user running the webserver (owner AND group).
Even though the directory has a sticky bit set to the group permissions!
I couldn't find any settings to change this via php.ini or even using "umask()".

I want my regular user on the server to be able to "tar cjf" the directory .. which would fail on files totally owned by the webserver-process-user;
the "copy(from, to)" function obeys the sticky-bit though!
2008-08-17 17:02:01
http://php5.kiev.ua/manual/ru/function.move-uploaded-file.html
Автор:
I have the same problem as the person two comments below me. When I use the move_uploaded_file function the permissions for the file are set to 0600. No matter what configurations you set.

I searched the internet and I found more people with the same problems, but no solutions. I set the umask of apache to 013 and still the files were set to 0600. 

The copy function solves the problem. Another way to solve this problem is using the chmod function after uploading.
2008-08-27 12:36:13
http://php5.kiev.ua/manual/ru/function.move-uploaded-file.html
Автор:
For those using PHP on Windows and IIS, you SHOULD set the "upload_tmp_dir" value in php.ini to some directory around where your websites directory is, create that directory, and then set the same permissions on it that you have set for your websites directory. Otherwise, when you upload a file and it goes into C:\WINDOWS\Temp, then you move it to your website directory, its permissions will NOT be set correctly. This will cause you problems if you then want to manipulate that file with something like ImageMagick's convert utility.
2008-10-13 16:41:19
http://php5.kiev.ua/manual/ru/function.move-uploaded-file.html
When you use move_uploaded_file function to upload a file with utf-8  filename to linux system, you probably check your result by browsing to see the file in the target directory so please make sure that your terminal emulator or your samba configuration is set the character encoding to utf-8 otherwise  your file will be shown as ?????? (unreadable character).
2009-10-19 03:03:32
http://php5.kiev.ua/manual/ru/function.move-uploaded-file.html
You can only move the uploaded file once.  You can use copy() if you need the file in more than one place.
<?php // RAY_temp_upload_example.php
error_reporting(E_ALL);
echo 
"<pre>" PHP_EOL;

// IF A FILE HAS BEEN UPLOADED
if (!empty($_FILES))
{
   
// SHOW THE UPLOADED FILES
   
print_r($_FILES);

   
// TRY TO MOVE THE FILE TWICE - SECOND MOVE RETURNS FALSE
   
if (!move_uploaded_file($_FILES["userfile"]["tmp_name"], $_FILES["userfile"]["name"])) echo "CANNOT MOVE {$_FILES["userfile"]["name"]}PHP_EOL;
    if (!
move_uploaded_file($_FILES["userfile"]["tmp_name"], $_FILES["userfile"]["name"])) echo "CANNOT MOVE {$_FILES["userfile"]["name"]}PHP_EOL;

   
// SHOW THE UPLOADED FILES AFTER THE MOVE - NO VISIBLE CHANGE
   
print_r($_FILES);
}

// END OF PHP, PUT UP THE HTML FORM TO GET THE FILE
?>
<!-- The data encoding type, enctype, MUST be specified as below -->
<form enctype="multipart/form-data" method="POST">
    <!-- MAX_FILE_SIZE must precede the file input field -->
    <input type="hidden" name="MAX_FILE_SIZE" value="300000" />
    <!-- Name of input element determines name in $_FILES array -->
    Send this file: <input name="userfile" type="file" />
    <input type="submit" value="Send File" />
</form>
2010-08-18 11:42:50
http://php5.kiev.ua/manual/ru/function.move-uploaded-file.html
When uploading a file with a very long filename, for example 255 characters, move_uploaded_file fails. The longest file I've succesfully uploaded has a 247 character filename. So, although you can create a 250 character filename locally the server may not be able to move it.
2011-03-30 15:55:42
http://php5.kiev.ua/manual/ru/function.move-uploaded-file.html
A note for PHP on Windows IIS platform:
PHP does obviously not like directory traversing among partitions, so if you set upload_tmp_dir to be on different partition as php-cgi.exe or php.exe is, upload_tmp_dir will NOT be accessible for file uploads! You will get ERROR 6 on any attempt to upload file, and file size will be 0.
Resolution is to have upload_tmp_dir set to a path under PHP install folder.
...and make sure this folder (and also session_save_path folder) has at least read/write permissions granted to AppPool owner (usually NETWORK SERVICE) and IIS web user (by default IUSR_).
2011-05-03 19:07:52
http://php5.kiev.ua/manual/ru/function.move-uploaded-file.html
The destination directory must exist; move_uploaded_file() will not automatically create it for you.
2011-07-22 16:26:58
http://php5.kiev.ua/manual/ru/function.move-uploaded-file.html
Security tips you must know before use this function :

First : make sure that the file is not empty.

Second : make sure the file name in English characters, numbers and (_-.) symbols, For more protection.

You can use below function as in example

<?php

/**
 * Check $_FILES[][name]
 *
 * @param (string) $filename - Uploaded file name.
 * @author Yousef Ismaeil Cliprz
 */
function check_file_uploaded_name ($filename)
{
    (bool) ((
preg_match("`^[-0-9A-Z_\.]+$`i",$filename)) ? true false);
}

?>

Third : make sure that the file name not bigger than 250 characters.

as in example :

<?php

/**
 * Check $_FILES[][name] length.
 *
 * @param (string) $filename - Uploaded file name.
 * @author Yousef Ismaeil Cliprz.
 */
function check_file_uploaded_length ($filename)
{
    return (bool) ((
mb_strlen($filename,"UTF-8") > 225) ? true false);
}

?>

Fourth: Check File extensions and Mime Types that you want to allow in your project. You can use : pathinfo() http://php.net/pathinfo

or you can use regular expression for check File extensions as in example

#^(gif|jpg|jpeg|jpe|png)$#i

or use in_array checking as

<?php

$ext_type 
= array('gif','jpg','jpe','jpeg','png');

?>

You have multi choices to checking extensions and Mime types.

Fifth: Check file size and make sure the limit of php.ini to upload files is what you want, You can start from ini.core#ini.file-uploads

And last but not least : Check the file content if have a bad codes or something like this function function.file-get-contents.

You can use .htaccess to stop working some scripts as in example php file in your upload path.

use :

AddHandler cgi-script .php .pl .jsp .asp .sh .cgi
Options -ExecCGI 

Do not forget this steps for your project protection.
2013-02-18 00:59:42
http://php5.kiev.ua/manual/ru/function.move-uploaded-file.html
Автор:
Nowhere does it say how to get the error/warning message when this fails.

The only way I know of doing it is something like this:

   if (move_uploaded_file($_FILES["file1"]["tmp_name"], $target_file)) {
      echo "<P>FILE UPLOADED TO: $target_file</P>";
   } else {
      echo "<P>MOVE UPLOADED FILE FAILED!</P>";
      print_r(error_get_last());
   }
2015-01-05 17:33:21
http://php5.kiev.ua/manual/ru/function.move-uploaded-file.html
Автор:
For those which will use inotify-tools to start an event when move_uploaded_file put the file in a specific directory, be aware that move_uploaded_file will trigger the create event, and not the move event of inotify-tools.
2019-03-19 12:25:20
http://php5.kiev.ua/manual/ru/function.move-uploaded-file.html
Ensure the upload temporary directory and the destination directory have "write" permissions for Other.
2023-05-19 19:04:55
http://php5.kiev.ua/manual/ru/function.move-uploaded-file.html
When using move_uploaded_file(). If the user uploads an image with a name that already exists, move_uploaded_file() will overwrite it. It's a good practice to store images in directories that you generate upon creating ur card/user/product etc...

<?php
   
function generateDir(int $n): string {
         
$characters="0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
       
$dir "";
        for(
$i 0$i<$n$i++){
           
$index rand(0strlen($characters)-1);
           
$dir .= $characters[$index];
        }
        return 
$dir;
    }

   
$image $_FILES["image"];
   
$imagePath 'images/'generateDir(10) .'/'$image["name"];

   
// Make the directory first or else it will not proceed with the upload.
   
mkdir($imagePath);
   
   
// some error handling etc...

   
move_uploaded_file($image["tmp_name"],  $imagePath);
?>
2023-07-06 17:54:33
http://php5.kiev.ua/manual/ru/function.move-uploaded-file.html
Permissions issue.

If you have set a setgid I.e g+s on the folder and wondering why the created files are owned by www-data:www-data, note that uploaded files are first saved in /tmp folder with the web user.

The move_uploaded_file() command moves the files from /tmp to the given TO directory, including the current permissions the /temp file has.

Hence the setgid gets ignored and doesn't inherit the parent permissions.
2024-02-26 11:53:59
http://php5.kiev.ua/manual/ru/function.move-uploaded-file.html

    Поддержать сайт на родительском проекте КГБ