How to upload files using PHP?

Updated: 22 October 2026 · Applies to: PHP, any version with the standard file-upload functions

This is the minimum code needed to let a visitor upload a file to your hosting through a browser form.

1. The upload form

<form enctype="multipart/form-data" action="upload.php" method="POST">
Please choose a file: <input name="uploaded" type="file" /><br />
<input type="submit" value="Upload" />
</form>

This form posts to upload.php, which handles the actual upload.

2. upload.php

<?php
$target = "upload/";
$target = $target . basename($_FILES['uploaded']['name']);
if (move_uploaded_file($_FILES['uploaded']['tmp_name'], $target)) {
    echo "The file " . basename($_FILES['uploaded']['name']) . " has been uploaded";
} else {
    echo "Sorry, there was a problem uploading your file.";
}
?>

$target is the folder uploaded files are saved into; create this folder first, or move_uploaded_file will fail.

Before using this on a real site

This bare example accepts any file of any type and size from anyone who can reach the form; it is a starting point, not something to deploy as-is. At minimum, before putting this live:

• Check the uploaded file's extension and MIME type against an allow-list of what you actually expect (images, PDFs, and so on), not a block-list.
• Enforce a maximum file size, both in PHP (upload_max_filesize, post_max_size) and in your own code.
• Store uploads outside the web root, or in a directory your web server is configured not to execute scripts from, so an uploaded file disguised as an image cannot be requested and run as PHP.
• Generate a new, random filename instead of trusting the uploaded file's own name.