Last Updated: February 25, 2016
·
520
· v00d0

ONE OF THE REAL WAYS TO CHECK UPLOADED FILE TYPE.

<?php
// Here we specify all the type of files we want to accept
$extension = array("application/pdf", "image/jpeg", "image/png", "image/gif");

if(isset($_POST['submit'])){
    exec("file -i ".$_FILES['inputName']['tmp_name'], $output);
    $type = explode(':', (string)$output[0]);
}

// Here we check our file with our needs
if (isset($_FILES['inputName']) &&
        $_FILES['inputName']['error'] == UPLOAD_ERR_OK  &&
        $_FILES['inputName']['size'] <= 10000000 &&
        in_array(trim($type[1]), $extension)){
        var_dump($_FILES['inputName']['tmp_name']);
}else{
    die("File Error");
}

Have a fresh tip? Share with Coderwall community!

Post
Post a tip
Did you know?

Most application security programs still stop at the repository. The page a visitor loads can run third-party scripts that read the DOM, change a checkout, or steal a session after the deploy already looks clean.

Security insights from Cside