is_uploaded_file()

The is_uploaded_file() function checks whether a given file was uploaded through an HTTP POST request. It is one of PHP's core security tools for file uploads: it lets you confirm that a path really points to a temporary file that PHP itself created from the current request — not to an arbitrary path an attacker may have slipped into your script.

This chapter covers the syntax, a working example, the security problem the function solves, and the gotchas that trip people up.

Syntax

is_uploaded_file(string $filename): bool

• $filename — the path to check. In practice this is always a value taken from $_FILES['...']['tmp_name'].
• Return value — true if $filename is an uploaded file from the current request, false otherwise.

The function only returns true for the temporary filename PHP assigned during the upload. Passing a path you built yourself (for example the final destination after moving the file) returns false.

Basic example

<?php

$file = $_FILES['file']['tmp_name'];

if (is_uploaded_file($file)) {
    echo 'The file was uploaded via HTTP POST.';
} else {
    echo 'The file was NOT uploaded via HTTP POST.';
}

Here $_FILES['file'] is the entry created when a form field named file is submitted with enctype="multipart/form-data". The tmp_name key holds the server-side temporary path, and is_uploaded_file() verifies it genuinely came from the request.

Why the function exists (security)

Without this check, an attacker could submit a normal form field (not a file) whose value is a server path such as /etc/passwd. If your code blindly trusted that string and then read or copied it, you would expose system files. is_uploaded_file() defends against this by returning true only for files PHP itself received as uploads in the current request.

A safe upload handler validates the file before doing anything with it:

<?php

if (
    isset($_FILES['file']) &&
    $_FILES['file']['error'] === UPLOAD_ERR_OK &&
    is_uploaded_file($_FILES['file']['tmp_name'])
) {
    $destination = __DIR__ . '/uploads/' . basename($_FILES['file']['name']);

    if (move_uploaded_file($_FILES['file']['tmp_name'], $destination)) {
        echo 'File stored safely.';
    } else {
        echo 'Failed to move the uploaded file.';
    }
} else {
    echo 'No valid upload received.';
}

Note that move_uploaded_file() performs the same is_uploaded_file() check internally, so it is the preferred way to relocate an upload. Use is_uploaded_file() directly when you need to inspect or read the temporary file before moving it.

is_uploaded_file() vs. move_uploaded_file()

Common gotchas

• Always pass tmp_name, never the final path. After you move a file with move_uploaded_file(), the temporary file no longer exists, so checking it again returns false.
• The check is per-request. A path that was an upload in a previous request is not valid in the current one.
• It does not validate content. is_uploaded_file() says nothing about the file's type or size. Validate $_FILES['file']['size'], the MIME type, and the extension separately before trusting user data.
• Check the error code first. Inspect $_FILES['file']['error'] === UPLOAD_ERR_OK before calling is_uploaded_file(); a failed upload may leave tmp_name empty.

Related functions

• move_uploaded_file() — safely move an uploaded file to its destination.
• $_FILES and other superglobals — how uploaded-file data is exposed to your script.
• PHP File Upload — the full HTML form plus PHP handler for accepting files.

Summary

is_uploaded_file() returns true only for the temporary file PHP created from an HTTP POST upload in the current request. Combined with the upload error code and content validation, it is the foundation of secure file handling in PHP. In most cases you let move_uploaded_file() do the check for you, and reach for is_uploaded_file() directly only when you must read the temp file before moving it.

Practice