is_uploaded_file()

is_uploaded_file() — Tells whether the file was uploaded via HTTP POST.

Built-in function of PHP 8.5. The manual lists it as available in PHP 4 >= 4.0.3, PHP 5, PHP 7, PHP 8. This page is the reference card: signature, parameters and return value, plus the changelog and the example the manual provides.

What it does

Returns true if the file named by filename was uploaded via HTTP POST. This is useful to help ensure that a malicious user hasn't tried to trick the script into working on files upon which it should not be working--for instance, /etc/passwd.

Signature

is_uploaded_file(string $filename): bool

Parameters

Return value

Returns true on success or false on failure.

Example

A runnable snippet:

if (is_uploaded_file($_FILES['userfile']['tmp_name'])) { echo "File ". $_FILES['userfile']['name'] ." uploaded successfully.\n"; echo "Displaying contents\n"; readfile($_FILES['userfile']['tmp_name']); } else { echo "Possible file upload attack: "; echo "filename '". $_FILES['userfile']['tmp_name'] . "'."; }

See also

move_uploaded_file()

All PHP 8.5 built-in functions

Reference card built from the PHP manual page is_uploaded_file() (PHP documentation, CC BY 3.0). The page is generated from the manual, so the wording of the parameter and return value text follows php.net.