Debian 9 Stretch adds private temporary directories, so if you use this function when running as mod_php in Apache expecting that the file can be made available to a third party (e.g. in a shell command or a MariaDB load from temporary file command), it will no longer work: the file will not be visible to other processes, (though the same PHP will be able to read it back in).
Either you need to use the first parameter to put the temporary file somewhere specific (outside the HTML document tree) with permissions such that you can share it with the other party, or change the settings for private tmp, for example:
cp /lib/systemd/system/apache2.service /etc/systemd/system/
# edit /etc/systemd/system/ to change PrivateTmp=true to false
systemctl daemon-reload
service apache2 restart
Choosing a different location is better on a shared server - private tmp files were added for a reason.
This was something that puzzled me for ages when doing a recent OS upgrade.
