PHP remember file field contents

You can’t “pre-fill” the contents of a file upload field for security reasons. Also, that would mean the file would get re-uploaded every time the form is submitted, which would not be good.

Instead, do this:

• Create a file upload field with name file_upload.
• On the server-side, process the upload in any case, even if the rest of the form validation fails.
• If the form validation failed, but the file was uploaded, insert a hidden input into the form with name file containing the name of the just uploaded file.
• Display a user-visible indication that the file is okay. If it’s an image, display a thumbnail version of it. If it’s any other file, display its filename and/or icon.
• If the user chooses to upload a different file in the file_upload field, process the upload and store the new value in file.

Pseudocode:

<?php
    $file = null;
    if (!empty($_POST['file'])) {
        $file = $_POST['file'];
    }
    if (!empty($_FILES['file_upload'])) {

        // process upload, save file somewhere

        $file = $nameOfSavedFile;
    }

    // validate form
?>


<input type="file" name="file_upload" />
<input type="hidden" name="file" value="<?php echo $file; ?>" />
<?php
    if (!empty($file)) {
        echo "File: $file";
    }
 ?>

Important note

This mechanism can allow any user to claim other user’s files as their own, by including a file name that they guessed exists on your server. You will want to ensure that uploaded files are clearly associated with a specific user to avoid this issue.