How to check file types of uploaded files in PHP?

On the PHP website, the only real checking they suggest is using is_uploaded_file() or move_uploaded_file(), here. Of course you usually don't want user's uploading any type of file, for a variety of reasons.

Because of this, I have often used some "strict" mime type checking. Of course this is very flawed because often mime types are wrong and users can't upload their file. It is also very easy to fake and/or change. And along with all of that, each browser and OS deals with them differently.

Another method is to check the extension, which of course is even easier to change than mime type.

If you only want images, using something like getimagesize() will work.

What about other types of files? PDFs, Word documents or Excel files? Or even text only files?

Edit: If you don't have mime_content_type or Fileinfo and system("file -bi $uploadedfile") gives you the wrong file type, what other options are there?

Answers


Take a look at mime_content_type or Fileinfo. These are built-in PHP commands for determining the type of a file by looking at the contents of the file. Also check the comments on the above two pages, there are some other good suggestions.

Personally I've had good luck using something that's essentially system("file -bi $uploadedfile"), but I'm not sure if that's the best method.


IMHO, all MIME-type checking methods are useless.

Say you've got which should have MIME-type application/pdf. Standard methods are trying to find something that looks like a PDF header (%PDF- or smth. like that) and they will return 'Okay, seems like this is a PDF file' on success. But in fact this doesn't means anything. You can upload a file containing only %PDF-1.4 and it will pass MIME-check.

I mean if the file has an expected MIME-type - it will always pass the MIME-type check otherwise the result is undefined.


I assume you are going to have a fixed white-list of file-types that you will accept.

For each of these types, you are going to have to use different techniques to verify that they are valid examples of that format.

There are two related questions:

  • Does it look roughly like it might be the right type? (For JPEG, you could check the headers, as you mentioned. For many Unix-based formats, you could check the "magic cookie".)

  • Is it actually a valid example of that type (e.g. For any XML-like format, you could validate against a DTD.)

I think that, for each format, you should ask separate questions for each one, because the answer will be quite different for PDFs compared to ZIP files.


I used mime_content_type that is compatible with PHP 5.2, because I can use neither Fileinfo (it requires PHP 5.3) nor system(), that is disabled by my provider. For example, I check if a file is a text file so:

if (strcmp(substr(mime_content_type($f),0,4),"text")==0) { ... }

You can see a full example in my "PHP Directory and Subdirectory Listener & File Viewer and Downloader" at: http://www.galgani.it/software_repository/index.php


if(isset($_FILES['uploaded'])) {
    $temp = explode(".", $_FILES["uploaded"]["name"]);

    $allowedExts = array("txt","htm","html","php","css","js","json","xml","swf","flv","pdf","psd","ai","eps","eps","ps","doc","rtf","ppt","odt","ods");

    $extension = end($temp);
    if( in_array($extension, $allowedExts)) {
       //code....

    } else {
        echo "Error,not Documentum type...";
    }
}

Here is the function file_mime_type from iZend:

function file_mime_type($file, $encoding=true) {
    $mime=false;

    if (function_exists('finfo_file')) {
        $finfo = finfo_open(FILEINFO_MIME);
        $mime = finfo_file($finfo, $file);
        finfo_close($finfo);
    }
    else if (substr(PHP_OS, 0, 3) == 'WIN') {
        $mime = mime_content_type($file);
    }
    else {
        $file = escapeshellarg($file);
        $cmd = "file -iL $file";

        exec($cmd, $output, $r);

        if ($r == 0) {
            $mime = substr($output[0], strpos($output[0], ': ')+2);
        }
    }

    if (!$mime) {
        return false;
    }

    if ($encoding) {
        return $mime;
    }

    return substr($mime, 0, strpos($mime, '; '));
}

Need Your Help

UICollectionView effect on iPhone

ios uicollectionview

I'm writing an application and I would like to insert the same effect as this photo below.

Why does std::is_copy_constructible<T&&>::value return false?

c++ templates c++11 language-lawyer

It seems that is_copy_constructible&lt;T&amp;&amp;&gt; is false even when is_copy_constructible&lt;T&gt; is true for identical types T. I've tested this with gcc and with clang and get the same res...