PHP Thumbnail Image creation script

$source = imagecreatefromjpeg(__DIR__ . '/images/photo.jpg');
if ($source !== false) {
    $thumb = imagescale($source, 240);
    if ($thumb !== false) {
        imagejpeg($thumb, __DIR__ . '/images/photo-thumb.jpg', 85);
        imagedestroy($thumb);
    }
    imagedestroy($source);
}

For uploaded images, validate the upload error, inspect the file with finfo, generate a server-side filename, and move it with move_uploaded_file(). Do not trust $_FILES['type'] or the original filename.

Upload and validate the source image

if (!isset($_FILES['userfile']) || $_FILES['userfile']['error'] !== UPLOAD_ERR_OK) {
    exit('Upload failed');
}

$tmp = $_FILES['userfile']['tmp_name'];
if (!is_uploaded_file($tmp)) {
    exit('Invalid upload');
}

$finfo = new finfo(FILEINFO_MIME_TYPE);
$mime = $finfo->file($tmp);
$allowed = [
    'image/jpeg' => 'jpg',
    'image/png' => 'png',
    'image/gif' => 'gif',
];
if (!isset($allowed[$mime])) {
    exit('Unsupported image type');
}

$filename = bin2hex(random_bytes(16)) . '.' . $allowed[$mime];
$sourcePath = __DIR__ . '/upimg/' . $filename;
if (!move_uploaded_file($tmp, $sourcePath)) {
    exit('Could not store upload');
}

Create a proportional thumbnail

[$width, $height] = getimagesize($sourcePath);
$thumbWidth = 180;
$thumbHeight = (int) round($thumbWidth / $width * $height);

$create = match ($mime) {
    'image/jpeg' => 'imagecreatefromjpeg',
    'image/png'  => 'imagecreatefrompng',
    'image/gif'  => 'imagecreatefromgif',
};
$save = match ($mime) {
    'image/jpeg' => 'imagejpeg',
    'image/png'  => 'imagepng',
    'image/gif'  => 'imagegif',
};

$source = $create($sourcePath);
$thumb = imagecreatetruecolor($thumbWidth, $thumbHeight);
imagecopyresampled($thumb, $source, 0, 0, 0, 0, $thumbWidth, $thumbHeight, $width, $height);

$thumbPath = __DIR__ . '/thimg/' . $filename;
$save($thumb, $thumbPath);
imagedestroy($source);
imagedestroy($thumb);

Keep upload and thumbnail directories non-executable at the web-server level, enforce a size limit before processing, and consider pixel-dimension limits to prevent decompression-bomb style resource exhaustion.

Subhendu Mohapatra

Author & Instructor at plus2net

I write and maintain practical tutorials on Python, PHP, SQL, JavaScript, HTML, jQuery, and web development at plus2net. The tutorials focus on clear explanations, working examples, and code that readers can test and adapt while learning.

About the author   Watch on YouTube

Connect: