The admin can do anything. If the admin is your enemy then you have lost. He can copy your precious files regardless of where you put them; he can even just read the RAM contents of your PHP process directly.
If the admin is your friend, then your next enemies are other people who have some kind of access to the same machine, e.g. normal (non-admin) users of the machine, and/or other PHP scripts running on the same server. PHP's tmpfile
relies (at least on Unix-like systems) on the tmpfile()
function provided by the OS (actually a libc function). If you use Linux, you are in luck: that specific implementation creates the file with a random name in /tmp
and immediately deletes it. As per Unix semantics, the file still exists (it takes some room in the filesystem) but the name is destroyed, forbidding any access from other users.
You might still have to fear other PHP scripts, if these are hostile and the PHP engine is not properly constrained, because these scripts run under the same account than yours (the account at the OS level, i.e. the Unix user which runs the Web server) and thus may access the file from a link in /proc
. But that's rather extreme; if distinct people, potentially hostile to each other, can add their own PHP scripts to the same server with no isolation between them, then there is something very wrong in the server structure, and the admin is not doing his job.