I want to discuss the topic of file security with you.
Currently, I have a PHP script that retrieves a file from an <input type="file"> tag and then uses file_get_contents() to store the file data in a variable. However, I am concerned about potential security risks associated with this process. Here is a snippet of the code:
$file_data = file_get_contents($_FILES[file]['tmp_name']);
$file = base64_encode($file_data);
In essence, all I do is extract the file content and send it to a RESTful API as a string without storing or moving the actual file.
Now, my dilemma is whether I should set up a separate web server to handle these requests or if it is safe to continue using this method on the main server. Given that our website receives a high volume of traffic, I must consider the possibility of individuals attempting to exploit the file field. The primary concern here is ensuring the security of the server hosting the script.
Thank you for your assistance.