File Upload Handling

<?php
function handleFileUpload(string $field, string $uploadDir): array
{
    $result = ['success' => false, 'error' => '', 'path' => ''];

    if (!isset($_FILES[$field]) || $_FILES[$field]['error'] !== UPLOAD_ERR_OK) {
        $result['error'] = 'Upload error: ' . ($_FILES[$field]['error'] ?? 'no file');
        return $result;
    }

    $file = $_FILES[$field];

    // Validate size (max 2 MB)
    if ($file['size'] > 2 * 1024 * 1024) {
        $result['error'] = 'File exceeds 2 MB limit.';
        return $result;
    }

    // Validate MIME type using finfo (not browser type)
    $finfo    = new finfo(FILEINFO_MIME_TYPE);
    $mimeType = $finfo->file($file['tmp_name']);
    $allowed  = ['image/jpeg', 'image/png', 'image/gif', 'image/webp'];

    if (!in_array($mimeType, $allowed, true)) {
        $result['error'] = 'Only JPEG, PNG, GIF, and WebP images are allowed.';
        return $result;
    }

    // Generate a safe filename
    $ext      = pathinfo($file['name'], PATHINFO_EXTENSION);
    $safeName = bin2hex(random_bytes(16)) . '.' . strtolower($ext);
    $dest     = rtrim($uploadDir, '/') . '/' . $safeName;

    if (!move_uploaded_file($file['tmp_name'], $dest)) {
        $result['error'] = 'Failed to move uploaded file.';
        return $result;
    }

    $result['success'] = true;
    $result['path']    = $dest;
    return $result;
}