After uploading the file, use md5_file() to perform server-side verification

M66 2025-06-01

In web development, file uploading is very common, but with it comes the verification of file integrity and security. To ensure that the uploaded file has not been tampered with or corrupted, PHP provides the md5_file() function, which can calculate the MD5 hash value of the file, thereby achieving integrity verification.

This article will introduce in detail how to use the md5_file() function to verify the server-side integrity of uploaded files, and explain its application method in combination with actual PHP code examples.

What is the md5_file() function?

md5_file() is a built-in function in PHP that calculates the MD5 hash value of a specified file. MD5 is a widely used hashing algorithm that maps data of any length into a fixed length 32-bit string. By comparing whether the MD5 values of the files before and after uploading are consistent, we can determine whether the files have changed.

Function prototype:

 string md5_file ( string $filename [, bool $raw_output = false ] )

$filename : The file path that needs to be calculated for MD5 values.
$raw_output : If set to true , return the MD5 digest in the original binary format. By default, false returns a 32-bit hexadecimal string.

File upload and integrity verification process

The user uploads the file to the server through the form.
The server temporarily saves the uploaded file.
The server calls md5_file() to calculate the MD5 value of the file.
Compare the MD5 value with the expected MD5 value in the client or database.
Determine whether the file is complete.

Actual sample code

Here is a complete file upload and integrity verification example:

 <?php
if ($_SERVER['REQUEST_METHOD'] == 'POST') {
    if (isset($_FILES['uploaded_file']) && $_FILES['uploaded_file']['error'] == UPLOAD_ERR_OK) {
        // Temporary path to upload files
        $tmpFilePath = $_FILES['uploaded_file']['tmp_name'];
        
        // Target save path（Can be modified according to requirements）
        $destination = __DIR__ . '/uploads/' . basename($_FILES['uploaded_file']['name']);
        
        // Mobile upload files to the target directory
        if (move_uploaded_file($tmpFilePath, $destination)) {
            
            // Calculate the uploaded fileMD5value
            $md5Hash = md5_file($destination);
            
            // Assuming the front-end or database knows the file in advanceMD5value（这里举例为固定value）
            $expectedMd5 = 'd41d8cd98f00b204e9800998ecf8427e';  // ExampleMD5
            
            // Verify file integrity
            if ($md5Hash === $expectedMd5) {
                echo "File upload successfully，And the file integrity verification is passed！";
            } else {
                echo "File upload successfully，But file integrity verification failed！";
            }
        } else {
            echo "File saving failed！";
        }
    } else {
        echo "No uploading files or uploading errors！";
    }
}
?>

HTML upload form example

 <form action="upload.php" method="post" enctype="multipart/form-data">
    <label for="file">Select File Upload：</label>
    <input type="file" name="uploaded_file" id="file" />
    <button type="submit">Upload</button>
</form>

Things to note

Security : When uploading files, you must strictly control the type and size to prevent malicious files from being uploaded.
MD5 collision : The MD5 algorithm has a collision risk. If the security requirements are extremely high, consider using a safer hash function, such as sha256_file() .
File path permissions : Ensure that the upload directory has write permissions and cannot be accessed directly through the URL to prevent leakage.
Client MD5 value : If the client provides file MD5 value, it should be transmitted through secure channels to prevent tampering.

Summarize

Using the md5_file() function to verify the integrity of uploaded files is a simple and effective way to quickly determine whether the file has been tampered with or uploaded incorrectly. Combined with other security measures in the upload process, it can improve the reliability and security of file processing.

md5_file