Is this code is safe or not (img upload) ? [PHP] I'd like to know if this code is usable, because I'm not sure, thank you. The code is used to upload images to a predefined folder for users.
if(isset($_FILES['avatar']) AND !empty($_FILES['avatar']['name'])) {
$tailleMax = 6844685465456456;
$extensionsValides = array('jpg', 'jpeg', 'gif', 'png');

if($_FILES['avatar']['size'] &lt;= $tailleMax) {

   $extensionUpload = strtolower(substr(strrchr($_FILES['avatar']['name'], '.'), 1));
   
   if(in_array($extensionUpload, $extensionsValides)) {

      $resultat = move_uploaded_file($_FILES['avatar']['tmp_name'], 'uploads/'.$_SESSION['id'].'.'.$extensionUpload);
       
      if($resultat) {

   

     echo &quot;success&quot;;
             
          } else {

            echo &quot;Erreur durant l'importation de votre photo de profil extension&quot;;
          }
       } else {
           
        echo &quot;Votre photo de profil doit être au format jpg, jpeg, gif ou png&quot;;
       }
    } else {
        
       echo &quot;Votre photo de profil ne doit pas dépasser 2Mo&quot;;
    }
 }else{
     echo ':/';
 }
Just a few remarks:
I am wondering how that magic value of 6844685465456456 was determined :) I don't think that is equivalent to 2 Mb.

You need to use proper indentation, especially when you have nested control blocks - readability is important. Lack of readability here can result in a greater likelihood of logic errors.

This code is not helpful at all:
 }else{
     echo ':/';
 }

It doesn't tell the user what the problem is. Don't you hate those forms that tell you 'invalid input, try again' but don't actually tell you the problem and leave you guessing ?

This code (borrowed from mickmackusa):
if (!move_uploaded_file($_FILES['avatar']['tmp_name'], &quot;uploads/{$_SESSION['id']}.{$extensionUpload}&quot;)) {
    exit(&quot;Erreur durant l'importation de votre photo de profil extension&quot;);
}

You are showing an error message to the user but it should be treated like an exception. This code could fail for several reasons like:

invalid file name
disk full/not mounted
etc

But at this point it's not the user fault. It's a malfunction in your application or a server issue. There is nothing the user can do. So I would handle the exception and send an alert. If your application is broken you'll want to be notified and fix it asap, before someone reaches out to you.

This code is not foolproof:
$resultat = move_uploaded_file($_FILES['avatar']['tmp_name'], 'uploads/'.$_SESSION['id'].'.'.$extensionUpload);

You are expecting that the session variable ID will be set. It's perfectly possible that the user has the page opened already and the session expires after some time. When submitting the form the session variable could be unset, unless you have more code elsewhere (an include perhaps) that verifies that the session is active. If there is no active session you'll probably redirect the user to the login page.
So the resulting file name could be incorrect and not what you expected (eg: .jpg). It could be one reason why move_uploaded_file would fail in your script. In itself it doesn't present an obvious security risk though but it is a bug.