On the PHP website, the only real checking they suggest is using is_uploaded_file()
or move_uploaded_file()
, here. Of course you usually don't want user's uploading any type of file, for a variety of reasons.
Because of this, I have often used some "strict" mime type checking. Of course this is very flawed because often mime types are wrong and users can't upload their file. It is also very easy to fake and/or change. And along with all of that, each browser and OS deals with them differently.
Another method is to check the extension, which of course is even easier to change than mime type.
If you only want images, using something like getimagesize()
will work.
What about other types of files? PDFs, Word documents or Excel files? Or even text only files?
Edit: If you don't have mime_content_type or Fileinfo and system("file -bi $uploadedfile") gives you the wrong file type, what other options are there?
The is_uploaded_file() function in PHP is an inbuilt function which is used to check whether the specified file uploaded via HTTP POST or not. The name of the file is sent as a parameter to the is_uploaded_file() function and it returns True if the file is uploaded via HTTP POST.
The PHP global $_FILES contains all the information of file. By the help of $_FILES global, we can get file name, file type, file size, temp file name and errors associated with file.
You can check the MIME type of the file using PHP's File Info Functions. If it returns with the type 'application/pdf' then it should be a PDF.
A file with the . php file extension is a plain-text file that contains the source code written in the PHP (it's a recursive acronym meaning PHP: Hypertext Preprocessor) programming language. PHP is often used to develop web applications that are processed by a PHP engine on the web server.
Take a look at mime_content_type or Fileinfo. These are built-in PHP commands for determining the type of a file by looking at the contents of the file. Also check the comments on the above two pages, there are some other good suggestions.
Personally I've had good luck using something that's essentially system("file -bi $uploadedfile")
, but I'm not sure if that's the best method.
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With