---
id: php-file-upload
title: "PHP File Upload"
category: "Programming_Language"
status: "draft"
verification_status: "conceptual"
canonical_id: ""
aliases: ["$_FILES", "enctype multipart", "PHP 파일 업로드"]
duplicate_of: ""
source_trust_level: "B"
confidence_score: 0.9
created_at: 2026-07-04
updated_at: 2026-07-04
review_reason: ""
merge_history: []
tags: ["php", "programming", "w3schools", "files", "upload", "security"]
raw_sources: ["https://www.w3schools.com/php/php_file_upload.asp"]
applied_in: []
github_commit: ""
---

# [[PHP File Upload]]

## 🎯 한 줄 통찰 (One-line insight)
Checking a file's extension alone is NOT proof it's a real image — the tutorial uses `getimagesize()` specifically to detect "fake images" (files renamed with an image extension but containing different content), showing that upload validation needs content-based checks, not just filename-based ones. [S1]

## 🧠 핵심 개념 (Core concepts)
- **Required setup** — `file_uploads = On` in php.ini; HTML form must have `method="post"` AND `enctype="multipart/form-data"`. [S1]
- **`$_FILES["fieldname"]`** — array holding uploaded file info: `["name"]`, `["tmp_name"]`, `["size"]`. [S1]
- **`getimagesize()`** — detects whether an uploaded file is a genuine image (vs. a renamed fake). [S1]
- **`file_exists()`** — checks for filename collisions before saving. [S1]
- **`pathinfo($file, PATHINFO_EXTENSION)`** — extracts the file extension for type-checking. [S1]
- **`move_uploaded_file($tmp_name, $target)`** — the final step that actually relocates the uploaded file from its temporary location to the destination. [S1]
- **`$uploadOk` flag pattern** — accumulates validation failures across multiple checks (file exists, size limit, file type) before deciding whether to actually move the file. [S1]

## 📖 세부 내용 (Details)
- Form requirements: `<form action="upload.php" method="post" enctype="multipart/form-data"> <input type="file" name="fileToUpload"> <input type="submit"> </form>`. [S1]
- Real-image check: `$check = getimagesize($_FILES["fileToUpload"]["tmp_name"]); if($check !== false) { $uploadOk = 1; } else { echo "File is not an image."; $uploadOk = 0; }`. [S1]
- Size limit (500KB): `if ($_FILES["fileToUpload"]["size"] > 500000) { echo "Sorry, your file is too large."; $uploadOk = 0; }`. [S1]
- Type whitelist: `if($imageFileType != "jpg" && $imageFileType != "png" && $imageFileType != "jpeg" && $imageFileType != "gif") { $uploadOk = 0; }`. [S1]
- Final move: `if ($uploadOk == 0) { echo "Sorry, your file was not uploaded."; } else { if (move_uploaded_file($_FILES["fileToUpload"]["tmp_name"], $target_file)) { echo "uploaded."; } }`. [S1]

## ⚖️ 모순 및 업데이트 (Contradictions & updates)
- **확장자만으로는 불충분**: getimagesize()로 실제 이미지 콘텐츠인지 확인해야 하며, 확장자 이름만으로는 가짜 이미지를 걸러낼 수 없다는 점이 강조됨. [S1]

## 🛠️ 적용 사례 (Applied in summary)
현재 발견된 실제 적용 사례가 없습니다 — 파일 존재 여부/크기/타입을 순차적으로 검사한 후 최종적으로 move_uploaded_file()로 이동하는 것이 안전한 업로드 처리의 표준 패턴이다. [S1]

## 💻 코드 패턴 (Code patterns)
Verifying the uploaded file is a genuine image (PHP):
```php
if (isset($_POST["submit"])) {
    $check = getimagesize($_FILES["fileToUpload"]["tmp_name"]);
    if ($check !== false) {
        echo "File is an image - " . $check["mime"] . ".";
    } else {
        echo "File is not an image.";
    }
}
```

## ✅ 검증 상태 및 신뢰도
- **상태:** draft
- **검증 단계:** conceptual
- **출처 신뢰도:** B (W3Schools — widely used educational reference, not a primary standards body)
- **신뢰 점수:** 0.90
- **중복 검사 결과:** 신규 생성 (New discovery)

## 🔗 지식 그래프 (Knowledge Graph)
- **상위/루트:** [[PHP Tutorial]]
- **관련 개념:** [[PHP File Create]], [[PHP Cookies]], [[PHP Filter]]
- **참조 맥락:** 파일 처리 섹션의 마지막 — 쿠키(Cookies) 섹션으로 이어짐.

## 📚 출처 (Sources)
- [S1] W3Schools — PHP File Upload — https://www.w3schools.com/php/php_file_upload.asp

## 📝 변경 이력 (Change history)
- 2026-07-04: Initial draft synthesized from the W3Schools "PHP File Upload" page (Astra wiki-curation, P-Reinforce v3.1 format).