I have read that one of the best things to do for security with user uploaded files is to store them outside of the web folder, as there is very little you can do to ensure that that jpg image the user is uploading is really an upload (MIME can be faked, etc.)

I have not seen a good tutorial on how to achieve this objective, however. I have managed hosting on a linux box, and my web folder is /public_html/, so how can I save files to /useruploads/ but still serve up the files using PHP/html?

1 Answer 1


Put the files outside of the webroot. Then using PHP pass the file though a script.

Sample PHP:

    $file = '/full/path/to/useruploads/secret.pdf';

    header('Content-Description: File Transfer');
    header('Content-Type: application/octet-stream');
    header('Content-Disposition: attachment; filename=' . basename($file));
    header('Content-Transfer-Encoding: binary');
    header('Expires: 0');
    header('Cache-Control: must-revalidate, post-check=0, pre-check=0');
    header('Pragma: public');
    header('Content-Length: ' . filesize($file));
  • But how do I save them there? Commented Apr 4, 2011 at 17:21
  • @Chris - You can upload files outside of your webroot using PHP. Any PHP file upload tutorial will work. Just set the upload directory to be /useruploads/ and you'll be all set.
    – John Conde
    Commented Apr 4, 2011 at 17:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.