How to check uploaded file type in PHP

Question

I used this code to check for the type of images,

$f_type=$_FILES['fupload']['type'];  if ($f_type== "image/gif" OR $f_type== "image/png" OR $f_type== "image/jpeg" OR $f_type== "image/JPEG" OR $f_type== "image/PNG" OR $f_type== "image/GIF") {     $error=False; } else {     $error=True; } 

but some users complain they get an error while uploading any type of images, while some others don't get any errors!

I was wondering if this fixes the problem:

if (mime_content_type($_FILES['fupload']['type']) == "image/gif"){...

Any comments?

Answer 1

Never use $_FILES..['type']. The information contained in it is not verified at all, it's a user-defined value. Test the type yourself. For images, exif_imagetype is usually a good choice:

$allowedTypes = array(IMAGETYPE_PNG, IMAGETYPE_JPEG, IMAGETYPE_GIF); $detectedType = exif_imagetype($_FILES['fupload']['tmp_name']); $error = !in_array($detectedType, $allowedTypes); 

Alternatively, the finfo functions are great, if your server supports them.

Answer 2

In addition to @deceze, you may also finfo() to check the MIME-type of non-image-files:

$finfo = new finfo(); $fileMimeType = $finfo->file($path . $filename, FILEINFO_MIME_TYPE);