Part 1: Form Handling

Firstly, lets fix your upload form handling. You should never send the user to a dedicated PHP file for processing, wether it’s a form or an upload because:

• The file then has to bootstrap WordPress to use the WP API, tightly coupling it to your folder structure, and introducing fragility
• The file will work even if the plugin has been disabled, introducing a security risk
• It’s no longer possible to modify and intercept the form handling code from elsewhere
• Numerous disadvantages regarding caching systems and performance

WordPress is a CMS, and you should let WordPress handle requests. Your job is to tell it what to do with those requests.

So this is how you handle a form:

template:

<form method="post">
    <?php wp_nonce_field( 'allens_form', 'allens_form_nonce' ); ?>
    <input type="hidden" name="allens_form" value="allens_form">
    ... form fields
</form>

In a plugin or theme functions.php:

add_action( 'init', 'allens_form_handler');
function allens_form_handler() {
    if ( empty( $_POST['allens_form'] ) ) {
        return; // this isn't a form submission
    }
    if ( ! wp_verify_nonce( $_POST['allens_form_nonce'], 'allens_form' )  ) {
        return; // invalid or missing nonce! Something dodgy's going on here
    }
    // process form data
}

Also notice the addition of a nonce. This should greatly increase the security of your form from certain types of attacks. Consider asking a new question on this site for a more comprehensive answer of what nonces are and what they protect against.

It may be tempting to use the same strategy for AJAX and use an AJAX endpoint file, but as I mentioned above, this is a bad idea for similar reasons. Instead, use the WP AJAX api, or register a REST API endpoint.

Part 2: Uploading Videos

All uploads go in the uploads folder. On a lot of systems the folder may be in a different place, and may be the only place in the filesystem that WordPress can write to. Your plugin folder should only contain code and assets, it should not contain user content.

The important missing piece of information here is post types.

All posts in WordPress have a ‘type’. Posts are of type ‘post’, Pages are of type ‘page’, etc, they’re all stored the same way in the database. There are other types of post too, but the one you should be interested in is the attachment post type.

When you upload anything into the media library, it’s put in the uploads folder, but WordPress doesn’t look in that folder to find uploads. Instead, when an upload is made, it creates a post of type attachment, and those attachment posts are what you see in the admin area.

Attachment post types contain information, such as the name of the attachment, where it can be found in the uploads folder, what type of file it is, the author, and other post meta depending on the type of media. These are what you want to use for your video uploads.

As posts can have parents, you’ll find that images uploaded and inserted into a post have this relation. Those images will be attachments, and the attachment posts parent is the post they appear in. This is also how featured images work, posts have a custom field/post meta that holds the ID of an attachment post. Said post is the image attachment for the featured image.

Importantly, there are several functions that you will find incredibly handy in implementing your upload, but the one you will find the most useful is this:

media_handle_upload( $file_id, $post_id, $post_data, $overrides );

This function when given the appropriate arguments will take your uploaded file, move it to the correct location, create an attachment post for you, and fill it with all the necessary metadata.

What you then do with the attachment post is up to you, but you will want to save the ID somewhere useful, and always refer to it by its ID. Never store the URL of an attachment. To get the URL for displaying on the page, use this function:

$url = wp_get_attachment_url( $attachment_id );

Be sure to check that the function worked, $url may be an error object, or a false value.