Where are temporary uploads stored in Apache+PHP by default?

Question

PHP

In php.ini parameter upload_tmp_dir is empty

; Каталог для временных файлов, в который PHP помещает закачанные
; файлы (используется системный временный каталог, если в директиве
; указана пустая строка):
upload_tmp_dir =

Where is given where this system temporary directory is located?
How long are files stored there?
Can an attacker upload a file there and run it if the folder has the wrong permissions?

Answer 1

OS dependent. On Linux, this is /tmp. You can make a simple form, upload a file and see what will be in $_FILES, there will be a full path to a temporary file. Deleted after the request is completed.