The php.net page on the move_uploaded_file() function contains a User Contributed Note which says,

Security tips you must know before use this function:

First: make sure that the file is not empty.

I really cannot see how an empty file could be any more of a problem than a file that has either benign or malicious contents. Nor have I ever seen this advice before. However, since the note is highly upvoted, perhaps I may be missing something. So, can allowing empty files to be uploaded create any security vulnerabilities/issues or is this part of the advice pointless?

  • Taking in consideration the rest of t-he tips like the file name restriction, it looks like OS level concerns.
    – elsadek
    Commented Sep 25, 2020 at 17:55
  • ... but not necessarily dealing with security. I bet there are some limitations in the function itself.
    – elsadek
    Commented Sep 25, 2020 at 18:05
  • @elsadek What sort of concerns? Filename limitations make sense they can cause problems but I'm pretty sure every filesystem can handle empty files. I don't see why the function wouldn't be able to handle empty files. Can you verify?
    – nobody
    Commented Sep 25, 2020 at 18:14
  • may be checking the source code will unveil something.
    – elsadek
    Commented Sep 25, 2020 at 18:36

2 Answers 2


I would say it's just security in depth. There are probably no reasons to accept an empty files and this could potentially lead to unexpected behaviors and security issues.

  • 1
    That's possible but I guess corrupt files would be much more likely to lead to unexpected behavior than empty files.
    – nobody
    Commented Sep 25, 2020 at 18:29

An empty file is not a problem by being empty, but can lead to problems down the line if the application processing it don't expect empty files.

Throwing an error and stopping processing when detecting an empty file saves work. Maybe the upload failed somehow, or a proxy on the way removed the file, or someone is feeding invalid data. Ending the request here means your validation routines don't need to check this file, as it have nothing to be checked.

  • So basically, it's just meant to be good coding advice, it's not meant to guard against some well-known security issue?
    – nobody
    Commented Nov 8, 2021 at 17:24
  • That attitude is more than bizarre. The first thing after an upload of multiple files would be to check they are all uploaded, and some checksum is correct - and that would fail.
    – gnasher729
    Commented Nov 8, 2021 at 18:08
  • And how you would know if the checksum is correct? Unless the user provides the checksum during upload, you can calculate it but have nothing to compare against.
    – ThoriumBR
    Commented Nov 8, 2021 at 20:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .