Webmasters Stack Exchange is a question and answer site for pro webmasters. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have read that one of the best things to do for security with user uploaded files is to store them outside of the web folder, as there is very little you can do to ensure that that jpg image the user is uploading is really an upload (MIME can be faked, etc.)

I have not seen a good tutorial on how to achieve this objective, however. I have managed hosting on a linux box, and my web folder is /public_html/, so how can I save files to /useruploads/ but still serve up the files using PHP/html?

share|improve this question

Put the files outside of the webroot. Then using PHP pass the file though a script.

Sample PHP:

    $file = '/full/path/to/useruploads/secret.pdf';

    header('Content-Description: File Transfer');
    header('Content-Type: application/octet-stream');
    header('Content-Disposition: attachment; filename=' . basename($file));
    header('Content-Transfer-Encoding: binary');
    header('Expires: 0');
    header('Cache-Control: must-revalidate, post-check=0, pre-check=0');
    header('Pragma: public');
    header('Content-Length: ' . filesize($file));
share|improve this answer
But how do I save them there? – Chris Sobolewski Apr 4 '11 at 17:21
@Chris - You can upload files outside of your webroot using PHP. Any PHP file upload tutorial will work. Just set the upload directory to be /useruploads/ and you'll be all set. – John Conde Apr 4 '11 at 17:47

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.