PHP: What is a good way to upload multiple large files?

Question

What is a good way to upload multiple large files in PHP?

Note: in my case I don't really need very large files, I need something like 40-50 or maybe 100 MB upload. My purpose and goal is mainly about documents upload in websites, these documents (pdf, doc, etc.) can sometimes be 20-30 MB and rarely 100+MB, where normally the php MAX_UPLOAD_FILESIZE is 10-20 MB. I think that having a large MAX_UPLOAD_FILESIZE is very bad and anyway allowing large file uploads in PHP (like 1GB+) is really a bad idea.

I have been reading, even here on SO, different solutions like plupload and some others (HTTP Upload, bigUpload, etc.) and I am not sure which way is better to consider.

As a principle, I'd like to find something with mantained code (not an abandoned library) and possibly following coding standards (PSR).

I think that writing all from scratch would be a huge work, but maybe I am wrong, if someone did that I would like to hear your experience. Of course if I can't find something that gives me what I need, I'll have to edit existing libraries or write one on my own.

I will give a try to plupload but my biggest concern is that it might not be well mantained. There is a v3 release but the stable is still the v2. If I understand correctly, the last updates of this library on GitHub were made in 2017 and this doesn't really reassure me. PHP but everything in general changes really quickly.

Problem 1: Server knows the size of the file only when the upload is finished

I think this is the first problem. I can't be sure about the file size until the upload is completed. If I have to give an error in PHP because the file is too big, I'd need to upload the file before. I could guess the size in javascript but I think that would be too hackable. Same thing for HTML5. All client-side checks could be "hacked" or manipulated even if it requires work, it is still doable

Problem 2: File chunking, is it the best solution?

I have read about file chunking, which is very interesting, but that is only client-side, right? Because to chunk a file on server-side, you go back to problem 1, you need to upload the whole file before chunking it. Is client-side chunking safe? Are there known vulnerabilities about it? (an example, could I exploit something out while the file is being uploaded?). I will read more about this later.

Also what about the time required to upload? Let's say you are using your phone in 4G to upload two PDFs or JPGs on a form, you have to upload 20-30 MB with a bad signal in that moment, let's say you take 30 seconds or 1 minute to upload them. Will the server stop listening after a while?

In any case, with file chunking, do I need to have a large MAX_FILESIZE_UPLOAD? Is usually the request sent (as a POST) with the entire file, which could return an error because the size exceeds the PHP limit? I would like to keep a normal PHP file size limit.

Problem 3: stopping file upload and deleting interrupted upload

What happens if I stop or I want to stop my upload? I guess that the server will find itself with a temporary file which is only partially uploaded.

Then, in general, is the best way to have a cron checking the /tmp (or whatever) folder and deleting uncompleted files?

Problem 4: overwriting interrupted uploads

What if the user uploads a new file that should overwrite the old one, but the old one was not completed? Let's say, user uploads a 10MB document but realizes it's the wrong one. He will probably reload the page or maybe click "Browse" again and upload the new one. So, all the temporary files should have a unique name. If I remember correctly, PHP already gives them a random name in /tmp/. Is this enough? Would it be better to manually give them a random name, maybe based on a timestamp?

In code words, something like:

$fileName = time() . '-' . uniqid() . '.tmp';

Problem 5: what about multiple files upload?

Let's say the user uploads 3 documents, 10 MB each one. Should the server receive them all at the same time or one by one? Or maybe is it the same? At a first look, I might think that multiple uploads at the same time could give more problems with server load. Maybe this is not that important though.

Problem 6: accessibility

Would all this be easily accessible? Do you think that a user using a screen-reader would be able to upload multiple (and possibly large) files without problems?

Conclusion

In conclusion I will take a look at existing libraries and test a bit if I can find a good solution for my needs. In general I would like to read comments or experiences that could help me understand possible difficulties and problems that I could encounter.

Answer 1

I will try to help you in your questions:

Problem 1: Server knows the size of the file only when the upload is finished

You need to configure upload_max_filesize and post_max_size to allow the maximum file upload you want to be able to receive in a single request.

And yes, you will know the size once the file has been uploaded, as your script will be executed once the file is completely uploaded.

You can have some kind of checking in your javascript to improve your UI to the customer.

Also if the file exceeds the maximum size, the file will not be available in your server script.

Problem 2: File chunking, is it the best solution?

I don't think this would be any better than uploading the whole file.

The speed will not be increased, so although you can paralelize the upload, the upload speed will be determined by the client speed, you will end up uploading 1 file at 10Mb/s or 10 files at 1Mb/s, at the end will be the same.

Also you will have a very complex code at the client and at the server to handle it, and you will have to handle new error scenarios.

It is not worth it.

Problem 3: stopping file upload and deleting interrupted upload

If the client stops the upload, your server code will not be executed as the request has not been completed.

Also you won't have any troubles with duplicated tmp files, the file is removed from tmp folder when you move it using move_uploaded_file and if you don't move the file will be deleted when your script has finished.

https://www.php.net/manual/en/features.file-upload.post-method.php

Problem 5: what about multiple files upload?

With multiple file uploads, i prefer to use diferent requests via javascript for each file, then you can paralelize or start uploading files one by one and show the user the upload process.

With javascript you can see the upload percent of each request, and it is very useful when uploading big files to give the user the feedback that the application is working properly.

Problem 6: accessibility

You will handle the same accessibility issues than uploading a small file.

Conclusion

The server side coding is independent of the file size you are trying to upload, as it just does some checks and moves the file to the proper location.

You will have to code some javascript to improve the ui to show the progress to the customer, and if you want to add the ability to cancel the upload, it is very easy as it is just an http request with a listener that updates the progress (https://stackoverflow.com/a/47638378/1445024)