Building a file upload and download system in PHP

I. Database Setup (MySQL)

The first step is setting up a database to store file metadata (filename, upload date, file path, etc.).

Create a Database: Use a MySQL client (e.g., phpMyAdmin, MySQL Workbench) to create a database named, for example, file_management.
Create a Table: Within that database, create a table named files with the following structure:

CREATE TABLE files (
    id INT AUTO_INCREMENT PRIMARY KEY,
    filename VARCHAR(255) NOT NULL,
    filepath VARCHAR(255) NOT NULL,
    upload_date DATETIME DEFAULT CURRENT_TIMESTAMP
);

- id: Unique identifier for each file.
- filename: Original name of the uploaded file.
- filepath: Path to the file on the server. Ideally, store files outside the web root.
- upload_date: Timestamp indicating when the file was uploaded.

II. HTML Form (upload.html)

This form provides the interface for users to select and upload files.

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>File Upload</title>
    <link rel="stylesheet" href="style.css">
</head>
<body>
    <div class="container">
        <h1>Upload a File</h1>
        <form action="upload.php" method="post" enctype="multipart/form-data">
            <input type="file" name="fileToUpload" id="fileToUpload">
            <button type="submit" name="submit">Upload</button>
        </form>
         <div id="uploadStatus"></div>
    </div>
    <script src="script.js"></script>
</body>
</html>

enctype="multipart/form-data": Crucial for handling file uploads. It specifies how the form data should be encoded.
input type="file": The file selection input. name="fileToUpload" is the name used to access the file data in PHP.
button type="submit": Submits the form to the upload.php script.
div id="uploadStatus": A container to display upload progress or messages via JavaScript.

III. PHP Upload Script (upload.php)

This script handles the file upload logic, including validation, storage, and database insertion.

<?php
// Database Configuration
$servername = "localhost";
$username = "your_username";
$password = "your_password";
$dbname = "file_management";

// Create connection
$conn = new mysqli($servername, $username, $password, $dbname);

// Check connection
if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
}

if (isset($_POST["submit"])) {
    $target_dir = "uploads/";  // Directory to store uploaded files (outside web root recommended)
    $target_file = $target_dir . basename($_FILES["fileToUpload"]["name"]);
    $uploadOk = 1;
    $imageFileType = strtolower(pathinfo($target_file, PATHINFO_EXTENSION));

    // Basic Validation
    // Check if file already exists
    if (file_exists($target_file)) {
        echo "Sorry, file already exists.";
        $uploadOk = 0;
    }

    // Check file size (example: limit to 5MB)
    if ($_FILES["fileToUpload"]["size"] > 5000000) {
        echo "Sorry, your file is too large.";
        $uploadOk = 0;
    }

    // Allow certain file formats (example: images)
    if($imageFileType != "jpg" && $imageFileType != "png" && $imageFileType != "jpeg"
    && $imageFileType != "gif" ) {
        echo "Sorry, only JPG, JPEG, PNG & GIF files are allowed.";
        $uploadOk = 0;
    }

    // Perform the upload
    if ($uploadOk == 0) {
        echo "Sorry, your file was not uploaded.";
    } else {
        if (move_uploaded_file($_FILES["fileToUpload"]["tmp_name"], $target_file)) {
            // Insert file information into the database
            $filename = basename($_FILES["fileToUpload"]["name"]);
            $filepath = $target_file; // Store the full path

            $sql = "INSERT INTO files (filename, filepath) VALUES ('$filename', '$filepath')";

            if ($conn->query($sql) === TRUE) {
                echo "The file ". htmlspecialchars( basename( $_FILES["fileToUpload"]["name"])) . " has been uploaded.";
            } else {
                echo "Error: " . $sql . "<br>" . $conn->error;
            }
        } else {
            echo "Sorry, there was an error uploading your file.";
        }
    }
}

$conn->close();

?>

Database Connection: Establishes a connection to the MySQL database using your credentials. Replace "your_username", "your_password", and "file_management" with your actual database credentials.
$_FILES Superglobal: Contains information about the uploaded file. $_FILES["fileToUpload"] provides an array of details, including name, temporary location, size, etc.
$target_dir: Specifies the directory where uploaded files will be stored. It’s critically important to store this directory outside of your web server’s document root for security reasons. Create the uploads directory if it does not exist and ensure the web server process has write permissions to it.
move_uploaded_file(): Moves the uploaded file from its temporary location to the specified $target_file. This is the core file upload function.
Database Insertion: After the file is successfully uploaded, the script inserts the filename and filepath into the files table. Storing the filepath allows you to later retrieve and serve the file for download.
Error Handling: Includes basic error checking (file existence, size, type) and provides feedback to the user.

IV. Download Script (download.php)

This script handles the file download process, retrieving the path from the database and setting the appropriate headers.

<?php
// Database Configuration (same as upload.php)
$servername = "localhost";
$username = "your_username";
$password = "your_password";
$dbname = "file_management";

// Create connection
$conn = new mysqli($servername, $username, $password, $dbname);

// Check connection
if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
}

if (isset($_GET['id'])) {
    $id = $_GET['id'];

    // Fetch file information from the database
    $sql = "SELECT filename, filepath FROM files WHERE id = '$id'";
    $result = $conn->query($sql);

    if ($result->num_rows > 0) {
        $row = $result->fetch_assoc();
        $filepath = $row['filepath'];
        $filename = $row['filename'];

        // Verify file exists on the server:
        if (file_exists($filepath)) {
            header('Content-Description: File Transfer');
            header('Content-Type: application/octet-stream');
            header('Content-Disposition: attachment; filename="' . $filename . '"');
            header('Expires: 0');
            header('Cache-Control: must-revalidate');
            header('Pragma: public');
            header('Content-Length: ' . filesize($filepath));
            readfile($filepath);
            exit;
        } else {
            echo "File not found.";
        }
    } else {
        echo "File not found in database.";
    }
} else {
    echo "Invalid request.";
}

$conn->close();
?>

$_GET['id']: Retrieves the file ID from the query string (e.g., download.php?id=1). This ID uniquely identifies the file to be downloaded.
Database Query: Queries the files table to retrieve the filepath associated with the given ID.
header() Functions: Set HTTP headers that instruct the browser how to handle the download.
- Content-Description: File Transfer: Indicates that the response is a file to be downloaded.
- Content-Type: application/octet-stream: Specifies the MIME type of the file (generic binary data).
- Content-Disposition: attachment; filename="...": Forces the browser to download the file with the specified filename.
- Content-Length: Specifies the size of the file.
readfile(): Reads the file from the filesystem and outputs it to the browser. This is the core function that delivers the file content.

V. File Listing and Download Links (index.php or similar)

A page to display the uploaded files and provide download links.

<?php
// Database Configuration (same as upload.php)
$servername = "localhost";
$username = "your_username";
$password = "your_password";
$dbname = "file_management";

// Create connection
$conn = new mysqli($servername, $username, $password, $dbname);

// Check connection
if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
}

$sql = "SELECT id, filename, upload_date FROM files";
$result = $conn->query($sql);

echo "<h1>Uploaded Files</h1>";
echo "<ul>";

if ($result->num_rows > 0) {
    while($row = $result->fetch_assoc()) {
        echo "<li>";
        echo $row["filename"] . " - Uploaded on: " . $row["upload_date"] . " - ";
        echo "<a href='download.php?id=" . $row["id"] . "'>Download</a>";
        echo "</li>";
    }
} else {
    echo "No files uploaded yet.";
}

echo "</ul>";

$conn->close();
?>

This script retrieves the filename, upload date, and ID of each file from the database.
It generates an HTML list of files.
Each list item includes a link that points to download.php, passing the file’s ID as a query parameter (?id=...).

VI. JavaScript (script.js – for enhancements, e.g., progress display)

document.getElementById('fileToUpload').addEventListener('change', function (e) {
    const file = e.target.files[0];
    if (file) {
        const fileSizeInMB = file.size / (1024 * 1024);
        const fileName = file.name;

    }
});

This Javascript file provides interactive functionality to your uploader.

VII. CSS (style.css – for styling)

body {
    font-family: sans-serif;
    margin: 0;
    padding: 0;
    background-color: #f4f4f4;
}

.container {
    width: 80%;
    margin: 20px auto;
    background-color: #fff;
    padding: 20px;
    border-radius: 8px;
    box-shadow: 0 0 10px rgba(0, 0, 0, 0.1);
}

h1 {
    text-align: center;
    color: #333;
}

form {
    display: flex;
    flex-direction: column;
    align-items: center;
}

input[type="file"] {
    margin-bottom: 20px;
    padding: 10px;
    border: 1px solid #ddd;
    border-radius: 4px;
}

button[type="submit"] {
    padding: 10px 20px;
    background-color: #4CAF50;
    color: white;
    border: none;
    border-radius: 4px;
    cursor: pointer;
    font-size: 16px;
}

button[type="submit"]:hover {
    background-color: #3e8e41;
}

ul {
    list-style-type: none;
    padding: 0;
}

li {
    margin-bottom: 10px;
}

a {
    color: #007bff;
    text-decoration: none;
}

a:hover {
    text-decoration: underline;
}

#uploadStatus {
    margin-top: 20px;
    padding: 10px;
    border-radius: 4px;
    background-color: #f9f9f9;
    border: 1px solid #ddd;
}

This CSS file provides aesthetic enhancement to your uploader.

Important Considerations and Security:

File Validation: Thoroughly validate the file type, size, and content on the server-side (in PHP) to prevent malicious uploads. Don’t rely solely on client-side validation (JavaScript) as it can be easily bypassed. Implement robust checks, including examining the file’s magic bytes (file signature).
Directory Security: Ensure the uploads directory is outside of your web server’s document root. This prevents direct access to uploaded files via the browser, mitigating the risk of executing malicious code. Set appropriate file permissions on the uploads directory to restrict access to the web server process.
Filename Sanitization: Sanitize filenames to prevent directory traversal attacks and other vulnerabilities. Use a function like basename() to extract the filename and remove or replace potentially dangerous characters.
Error Handling: Implement comprehensive error handling and logging to identify and address issues quickly. Avoid displaying sensitive error information to the user. Log errors to a file or database for analysis.
SQL Injection: Protect against SQL injection by using prepared statements or parameterized queries when interacting with the database. Never directly embed user input into SQL queries. The example I provided uses string interpolation for brevity, but in a production environment, prepared statements are essential.
Cross-Site Scripting (XSS): Sanitize any user-provided data (e.g., filenames displayed on the file listing page) to prevent XSS attacks. Use functions like htmlspecialchars() to escape HTML entities.
File Size Limits: Enforce file size limits in both the HTML form and the PHP script to prevent denial-of-service attacks. Adjust the upload_max_filesize and post_max_size directives in your php.ini file accordingly.
Regular Security Audits: Conduct regular security audits of your code to identify and address potential vulnerabilities.

This comprehensive explanation covers the fundamental aspects of creating a file upload and download system. Applying strict validation, security measures and regularly maintaining the code remains crucial for a safe and trustworthy system.