: How do I save user uploaded files outside of the web folder but use them on my page? I have read that one of the best things to do for security with user uploaded files is to store them

@Kevin317

Put the files outside of the webroot. Then using PHP pass the file though a script.

Sample PHP:

<?php
$file = '/full/path/to/useruploads/secret.pdf';

header('Content-Description: File Transfer');
header('Content-Type: application/octet-stream');
header('Content-Disposition: attachment; filename=' . basename($file));
header('Content-Transfer-Encoding: binary');
header('Expires: 0');
header('Cache-Control: must-revalidate, post-check=0, pre-check=0');
header('Pragma: public');
header('Content-Length: ' . filesize($file));
ob_clean();
flush();
readfile($file);
exit;
?>

Vote Up Vote Down