A simple and secure PHP image uploader

v4.0.1 2018-06-23 22:16 UTC


Latest Stable Version Total Downloads Scrutinizer Code Quality Gitter chat License

Bulletproof is a single-class library to upload images in PHP with security.


Using git

$ git clone

Or composer

$ composer require samayo/bulletproof:4.0.*

Or download it manually based on the archived version of release-cycles.


Create an HTML form like this.

<form method="POST" enctype="multipart/form-data">
  <input type="hidden" name="MAX_FILE_SIZE" value="1000000"/>
  <input type="file" name="pictures" accept="image/*"/>
  <input type="submit" value="upload"/>

And copy & paste the following code to upload the image

require_once  "path/to/bulletproof.php";

$image = new Bulletproof\Image($_FILES);

  $upload = $image->upload(); 

    echo $upload->getFullPath(); // uploads/cat.gif
    echo $image->getError(); 

To use the full potential of bulletproof, check the following codes & examples.


Setting Properties

Before uploading, you can use these methods to restrict the image size, dimensions, mime types, location...

// Pass a custom name, or leave it if you want it to be auto-generated

// define the min/max image upload size (size in bytes) 
$image->setSize($min, $max); 

// define allowed mime types to upload
$image->setMime(array('jpeg', 'gif'));  

// set the max width/height limit of images to upload (limit in pixels)
$image->setDimension($width, $height); 

// pass name (and optional chmod) to create folder for storage
$image->setLocation($folderName, $optionalPermission);  

Getting Properties

Methods for getting image info before/after upload.

// get the provided or auto-generated image name

// get the image size (in bytes)

// get the image mime (extension)

// get the image width in pixels

// get the image height in pixels

// get image location (folder where images are uploaded)

// get the full image path. ex 'images/logo.jpg'

// get the json format value of all the above information

Slightly more customized ways to upload

To set and get image info, before or after image upload, use as:

$image = new Bulletproof\Image($_FILES);

      ->setLocation(__DIR__ . "/avatars");

    echo $image->getName(); // samayo
    echo $image->getMime(); // gif
    echo $image->getLocation(); // avatars
    echo $image->getFullPath(); // avatars/samayo.gif
Image Manipulation

If you want to crop, resize or watermark images, use the functions in the separate folder: src/utils

Creating your own custom errors

To create your own errors and responses, instead of the default error messages, use exceptions:


  try {
    if($image->getMime() !== 'png'){
      throw new \Exception('Only PNG image types are allowed');

    // do the same to check size, dimension ...

    if(!$upload = $image->upload()){
      throw new \Exception($image->getError());
    } else {
      echo $image->getFullPath();
  } catch (\Exception $e){
    echo "Error " . $e->getMessage();

What makes this secure?

  • Uses exif_imagetype() to get the true image mime (.extension)
  • Uses getimagesize() to check if image has a valid height / width in pixels.
  • Sanitized images names, strict folder permissions and more...

License: MIT