move_uploaded_file()
move_uploaded_file() is a native PHP function that moves a file that was uploaded via an HTTP POST request to a new destination.
Unlike a generic filesystem move, move_uploaded_file() first checks, using the same mechanism as is_uploaded_file(), that the source file was genuinely uploaded through PHP’s upload mechanism during the current request. This prevents an attacker from tricking a script into moving or overwriting an arbitrary file on the server by forging the tmp_name value.
move_uploaded_file() doesn’t validate the file’s content, type, or size: it must be combined with checks such as finfo, an extension allowlist, and a destination outside the web root to build a secure upload feature.
<?php
$uploaddir = '/var/www/uploads/';
$uploadfile = $uploaddir . basename($_FILES['userfile']['name']);
if (move_uploaded_file($_FILES['userfile']['tmp_name'], $uploadfile)) {
echo 'File is valid, and was successfully uploaded.';
} else {
echo 'Possible file upload attack!';
}
?>