Question

Am I enforced in some way to use move_uploaded_file() and/or delete the temporary file?

My application needs only to load the file contents in memory (eg. via file_get_contents()). Do I need to move it to another directory before? Otherwise, am I required to delete it at the end of the script?

Answer 1

Yes, in cases when open_basedir or safe mode (hopefully safe_mode will go out of style eventually) otherwise prevent you to read from the location the uploaded file was saved to. The move_uploaded_file() is aware of those restrictions but only enforce them to the second parameter, so you can move files out of lets say /tmp/ while otherwise you couldn’t read that directory.