Web Form File Validation Implementation Checklist

Implementing file upload functionality involves numerous security considerations and many easily overlooked pitfalls. This article explains a checklist for implementing file uploads that operate safely in production environments.

Checklist Overview

1. File size validation

• Upload limit is defined in bytes (no confusion between MB and MiB)
• For PHP, both upload_max_filesize and post_max_size are configured
• For Nginx, client_max_body_size includes an allowance for multipart overhead
• Error handling is in place for when $_FILES['file']['error'] is UPLOAD_ERR_INI_SIZE / UPLOAD_ERR_FORM_SIZE
• Minimum file size check is in place (excluding 0-byte files)

 $maxBytes) {
        throw new \RuntimeException(sprintf(
            'ファイルサイズ（%s）が上限（%s）を超えています',
            number_format($file['size']),
            number_format($maxBytes)
        ));
    }
}

2. File format validation (MIME type)

• The Content-Type ($_FILES['file']['type']) sent from the client is not trusted
• Server-side MIME type validation is performed using finfo / mime_content_type()
• A whitelist of allowed MIME types is defined

file($file['tmp_name']);

if (!in_array($mimeType, $allowed, true)) {
    throw new \RuntimeException('許可されていないファイル形式です: ' . $mimeType);
}

3. File extension validation

• A whitelist of file extensions is defined (whitelist, not blacklist)
• Double extensions (e.g., shell.php.jpg) are detected and rejected
• Case normalization is applied during validation (treating .JPG and .jpg as the same)

 2) {
    throw new \RuntimeException('不正なファイル名です');
}

$ext = strtolower(pathinfo($originalName, PATHINFO_EXTENSION));
if (!in_array($ext, $allowed, true)) {
    throw new \RuntimeException('許可されていない拡張子です: ' . $ext);
}

4. Magic byte (file signature) validation

• Magic bytes are validated for critical files (e.g., excluding executable files)