CODEWITHSUNDEEP
phpsecurityupload
HappyDeveloper
HappyDeveloper

Reputation: 12805

Can I trust the file type from $_FILES?

Can I trust the file type from $_FILES when uploading images? Or do I have to check again with exif_imagetype() ?

Upvotes: 8

Views: 859

Answers (5)

Salman Arshad
Salman Arshad

Reputation: 272116

No you cannot trust the $_FILES['userfile']['type'] variable. The value present in this variable could be forged. You can use finfo_file to detect file type more reliably:

$finfo = finfo_open(FILEINFO_MIME_TYPE); // we need mime type
echo finfo_file($finfo, "/path/to/uploaded/file"); // displays something like image/gif
finfo_close($finfo);

These functions require PHP >= 5.3.0.

Upvotes: 5

Jon
Jon

Reputation: 437386

No, you cannot trust it because this information is provided by the client browser.

$_FILES['userfile']['type'] The mime type of the file, if the browser provided this information. An example would be "image/gif". This mime type is however not checked on the PHP side and therefore don't take its value for granted.

Upvotes: 2

Sebastian Wramba
Sebastian Wramba

Reputation: 10127

From the documentation:

The mime type of the file, if the browser provided this information. An example would be "image/gif". This mime type is however not checked on the PHP side and therefore don't take its value for granted.

Upvotes: 7

Wesley van Opdorp
Wesley van Opdorp

Reputation: 14941

Never trust anything that comes from the outside, especially file uploads!

Check the size, location, mime/type, extenstion and anything else you can check!

Upvotes: 4

DarkBee
DarkBee

Reputation: 15625

I always use the next function to check on valid images :

function Check_Image($Filename) {
    if ($Check_Image = @getimagesize($Filename)) {
        return TRUE;
    }
    return FALSE;
}

Upvotes: 3

Related Questions