LykanShield protection layer

FileUpload Filter

Validate every uploaded file before application code can move or process it.

Read integration guide View source on GitHub →

Overview

One entry point for every upload shape

LykanShield walks through PHP’s $_FILES structure, including nested multi-file inputs, and normalizes every upload into an individual record. Each record is then checked for a dangerous filename and validated against the server-detected MIME allowlist.

Request lifecycle

How it works

  1. 01

    Normalize

    Single and nested upload arrays are converted into consistent file records.

  2. 02

    Inspect

    The original filename and temporary file contents are evaluated independently.

  3. 03

    Block and report

    Rejected uploads are reported with a dedicated event type before execution stops.

Implementation

Technical details

  • Processes every entry in $_FILES, including multi-file and directory-style uploads.
  • Skips empty inputs and respects PHP upload error codes.
  • Runs filename and MIME checks as separate security decisions.
  • Enabled automatically in lykan::run() and also available as a public method.

PHP integration

<?php
require __DIR__ . '/includes/lykan.class.php';
// Runs upload, bot, IP and injection protection.
lykan::run(__DIR__);
// Or invoke upload checks explicitly:
lykan::file_upload_protection();