I have a custom form with three file fields. The files are selected, then on submit they're attached to an email and sent off with a call to hook_mail.

I'm pretty sure the files aren't saved to the server and I don't want them saved as the files might be sensitive information.

But I want the fields to support certain file extensions. How can I validate them?

So Far

There is a function: file_validate_extensions which can validate but it only works for Drupal file objects and since these are never uploaded I'm not sure that works.

I tried using file_save_upload, as when a file is selected in a form (and not immediately uploaded) it's information appears in $_FILES so I tried to load the temporary path given there however it doesn't work.

(The path is of the form: C:\XAMPP\tmp\phpEDC6.tmp)

function mymodule_form_submit($form, $form_state) {
    $coverincluded = file_save_upload($_FILES['files']['tmp_name']['cover_letter_included'],
          'file_validate_is_image' => array(), // Validates file is really an image.
          'file_validate_extensions' => array('png gif jpg jpeg'), // Validate extensions.

     //unfortunately this dpm never shows, presumably because file_save_upload hasn't worked

1 Answer 1


This isn't a particularly clever solution, but hopefully it's ok. As far as I could tell you can't validate temporary files, they have to be uploaded.

So I ended up uploading them to the private directory and then immediately deleting them. Because some of the data might be sensitive I don't want to store them and this form takes place on a secure page.

function mymodule_form($form, &$form_state) {

   $form['file1'] = array(
     '#type' => 'file',
     '#title' => t('File1'),

   $form['file2'] = array(
     '#type' => 'file',
     '#title' => t('File2'),


Now for the important bit.

function mymodule_form_submit ($form, &$form_state) {
    //check if any file was attached
    if($_FILES['files']['tmp_name']['file1'] != '') {
      //Save and validate the file to the private file area
      $file1_included = file_save_upload('file1_included',
                                        'file_validate_is_image' => array(), // Validates file is really an image.
                                        'file_validate_extensions' => array('png gif jpg jpeg'), // Validate extensions.
                                      ), 'private://');
      //This is set-up for the email. Mimemail stores attachments in $params.
      $params['4'] =  array('uri'    => $file1_included->uri,
                          'filename' => $file1_included->filename,);
      //The file has been uploaded. So we'll set a variable which will be called later to delete it.
      $del_files['file1'] = $file1_included;


   if($_FILES['files']['tmp_name']['file2'] != '') {
   //.... same as file 1...

  //this will send an email. Note $params. We've put all our attachment information in 
  $message = drupal_mail('mymodule', 'notify', $email, language_default(), $params);

  //This function will delete all the files we've just uploaded. We check if
  //the variable has been set. And if it has then we call it and delete the relevant

  if (isset($del_files)){


This is the function we call to delete the files

function _mymodule_filedelete(&$del_files){
   //we know the variable exists, but now we have to check which files were uploaded.
   if(array_key_exists('file1' , $del_files)) {
    //and if they were uploaded. We delete them.
   if(array_key_exists('file2' , $del_files)) {

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.