Skip to main content

Creating an Admin-Only CSV Upload Form

A CSV upload changes stored data and should be restricted to administrators. Apply session and role checks before any output.

<?php
session_start();
if (!isset($_SESSION["user_id"])) {
    header("Location: login.php");
    exit;
}
if (($_SESSION["role"] ?? "") !== "admin") {
    http_response_code(403);
    exit("Permission denied.");
}
?>
<form method="post" enctype="multipart/form-data">
  <label for="dataset">CSV dataset</label>
  <input id="dataset" name="dataset" type="file" accept=".csv,text/csv" required>
  <button type="submit">Validate and import</button>
</form>

The multipart/form-data encoding is required. The accept attribute guides file selection but does not provide server-side security.

Check

  • Logged-out and standard users are rejected.
  • The form has a visible label.
  • File input has a restrictive accept hint.
  • Processing repeats the server-side role check.
Back to top