In a PHP file upload form, the name and extension of the file should be changed in order to prevent directory traversal attacks. I don't fully understand these attacks, therefore I'm uncertain if some of my other security checks might be prone to them.
I want to check file size and mime type:
$finfo = finfo_open(FILEINFO_MIME_TYPE); $mime = finfo_file($finfo, $file['tmp_name']); $filesize = filesize($file['tmp_name']); // check content of variables here
After that I want to move the file from the tmp directory to where they should be saved permanently with a secure file name.
Is the above code safe or should I move the file first and then do other security checks in order to prevent ever using
$file['tmp_name'] (except for moving the file)?