MAX_FILE_SIZE) { die('File is too large.'); } // 3. Validate MIME type (from PHP and potentially Finfo for better security) $finfo = new finfo(FILEINFO_MIME_TYPE); $mime_type = $finfo->file($file['tmp_name']); if (!in_array($mime_type, ALLOWED_MIME_TYPES)) { die('Invalid file type detected: ' . htmlspecialchars($mime_type)); } // 4. Validate file extension (after MIME type for extra check) $file_extension = strtolower(pathinfo($file['name'], PATHINFO_EXTENSION)); if (!in_array($file_extension, ALLOWED_EXTENSIONS)) { die('Invalid file extension.'); } // 5. Generate a unique and safe filename $new_filename = uniqid('upload_', true) . '.' . $file_extension; $destination = UPLOAD_DIR . $new_filename; // 6. Move the uploaded file to its final destination if (move_uploaded_file($file['tmp_name'], $destination)) { echo 'File uploaded successfully: ' . htmlspecialchars($new_filename); // IMPORTANT: Never directly serve user-uploaded files without proper sanitization // and setting appropriate Content-Type headers. } else { die('Failed to move uploaded file.'); } } ?>