Read uploaded file into variable instead saving it

Question

I want to be able to read an uploaded file, but I don't want the file to be saved on the server because of security concerns... Is it possible just to directly read a file into a variable?

If not, how does the Temp file thing work, how secure is it to save a temp file on the server, and when is it deleted?

by read you want to obtain the file type, size and name etc..? — Jay Harris, Jun 26 '13 at 19:16

score 2 · Accepted Answer · answered Jun 26 '13 at 19:00

You're going to have to save the upload to a file, otherwise any large file will cause an error because it'll overload available memory pretty easily.

Temp is VERY insecure, generally anybody on the system can read/write/delete your temp file.

The best way to go about this is just do a normal file upload, and in your submission script either read the file and process it or move it to a more permanent location. You can now issue a delete command to the tmp copy.

Since you may not have delete permission and/or the file could be auto deleted, it's best to issue the command this way (the @ symbol suppresses any errors, because you don't really care if the file is already deleted or what not, this is a "just in case" scenario)

@unlink($filename);

Great Answer! Thanks! What happen's if two file names are the same, does it just overwrite the old file? — Arian Faurtosh, Jun 26 '13 at 19:05

score 0 · Answer 2 · edited May 23 '17 at 12:11

0

So far as I'm aware it has to be stored somewhere in order to interact with it, but it's deleted as soon as your script finishes executing. See PHP: When does the temporary uploaded files get deleted?

edited May 23 '17 at 12:11

Community

1
1

answered Jun 26 '13 at 19:01

Ian Clark

9,237
4
32
49

Better to be safe than sorry and issue an @unlink($filename); just in case – TravisO Jun 26 '13 at 19:02

Read uploaded file into variable instead saving it

2 Answers2