PHP文件上传优化：临时文件存储与二次验证技巧

// 点击选择完成文件后，触发上传文件操作，将文件上传至服务器临时目录
$('.upload-real-file').off().on('change', function(){
  if(!$(this).val()){
    return false;
  }
  var responseObjId = $(this).attr('response-id');
  var responseObj = $('#' + responseObjId);
  $('#Form').ajaxSubmit({
    url:'/aa/bb/uploadTmpApkTool',
    resetForm: false,
    dataType: 'json',
    beforeSubmit: function(option){
      window.loading = layer.load(2);
    },
    success: function(data, statusText){
      layer.close(window.loading);
      if(data.status == 1){
        // 显示解析后的文件信息HTML
        responseObj.html(data.apkInfoHtml);
        // 更新文件名显示区域
        var parentContainer = responseObj.parent().parent(),
          nameContainer = parentContainer.find('.file-name-container');
        nameContainer.html(data.apkName);
        nameContainer.attr('title', data.apkName);
        // 将文件关键信息存入隐藏域，格式化为JSON字符串，供最终表单提交使用
        responseObj.find('.file-tmp').html(data.fileInfo); 
        // 启用提交按钮
        $(submitId).removeAttr('disabled');
      }else{
        layer.alert(data.info);
      }
    },
    error: function(data){
      layer.close(window.loading);
      layer.alert('未知错误，请稍后再试！');
    }
  });
  return false;//防止dialog 自动关闭
});

    $apkConfig = $this->_getApkConfig();
    $params = $this->getFilteredParam('get');
    $subFile = $_FILES['apkToolFiles'];
    $apkName = $apkInfoHtml = "";
    if(empty($subFile))
    {
      $this->ajaxReturn(array('status' => -4, 'info' => '请选择要上传的文件'));
    }

    foreach ($subFile['name'] as $subKey => $subVal)
    {
      if ($subFile['name'][$subKey])
      {
        $fileData = $this->_getFileData($subFile, $subKey);
        $checkData = array(
          'maxSize' => $apkConfig['FILE_MAX_SIZE'],
          'savePath' => $apkConfig['TMP_CHILD_PATH'],
          'extArr' => array('apk'),
          'releaseName' => str_replace('.apk', '', $fileData['fileName']), //特有
        );
        $checkResult = $this->_checkFileData($fileData, $checkData);
        if ($checkResult['status'] != 1)
        {
          $this->ajaxReturn($checkResult);
        }
        // 生成带有唯一标识的临时文件路径，防止重名冲突
        $filePath = $checkData['savePath'] . '/' . $fileData['fileName'] . '.tmp' . genRandStr(6);
        // 将PHP系统的临时文件移动到业务临时目录
        $this->_moveUploadedFile($fileData['tmpName'], $filePath);
        
        // 解析临时文件内容
        $apkInfo = $this->_apkParser($filePath); 
        
        // 业务规则校验示例
        if($apkInfo['UMENG_CHANNEL'] != 'UMENG_CHANNEL_VALUE')
        {
          @unlink($filePath);               // 删除校验不通过的无效文件
          $this->ajaxReturn(array('status' => 0, 'info' => "UMENG_CHANNEL的值要是 UMENG_CHANNEL_VALUE才行"));
        }
        
        // 记录用于最终提交的元数据，核心是保留相对路径
        $tmpFileArr['file_info'] = array(
          'name' => $subFile['name'][$subKey],
          'type' => $subFile['type'][$subKey],
          'tmp_name' => str_replace($apkConfig['TMP_CHILD_PATH'] . '/', '', $filePath),
          'error' => $subFile['error'][$subKey],
          'size' => $subFile['size'][$subKey],
        );       
      }
      else
      {
        $this->ajaxReturn(array('status' => 0, 'info' => "文件不能为空"));
      }
      
      // 拼接展示用HTML
      foreach ($apkInfo as $key => $val)
      {
        $apkInfoHtml .= "{$key}:{$val} \r\n";
      }
      $apkName = $fileData['fileName'];
      $version = $apkInfo['versionName'];
    }
    
    // 编码并转义，确保能安全嵌入前端DOM
    $fileInfo = htmlspecialchars(json_encode($tmpFileArr['file_info']));
    $fileInfoHtml = "<input name=\"apkToolFileTmp[]\" value='{$fileInfo}' type=\"hidden\"/>";  

    $this->ajaxReturn(array('status' => 1, 'info' => "上传成功", 'version' => $version, 'item' => $item, 'apkName' => $apkName, 'apkInfoHtml' => $apkInfoHtml, 'fileInfo' => $fileInfoHtml));
  }