PHP安全文件上传

Question

I have an upload form which allowed most of file types to be uploaded. Here they are:

• Image: jpg/jpeg/png/gif ...
• Video: mp4/avi/wmv ...
• another files: doc/pdf/rar/zip/mp3/...

For image file, I know I can use PHP function getimagesize() or something else to make sure it's the real image. But how about the other files such as Video, and documentation ? Is it a real file without faking the extension ?

How to do that?

Thank you! I need your help.

Answer 1

every file has it's own type, it called mime type , so u can check the mime type , do some things like that :

if (mime_content_type($FILES['file']['tmp'])== "image/png"))
{
// do upload
}else{
die('file type not supported');}

u can put all the mime type into an array the check the type with in_array function u can find all the mime type here : http://www.freeformatter.com/mime-types-list.html

Answer 2

Any client-side check (even the browser mime-type detection) is doomed to fail because user has access to it. You'd better let the upload begin and complete, then perform a serious server side check. You simply discard the file if that is not what you expected to be.

On top of the server-side check you can of course implement the client-side check just for a neater user experience

Answer 3

The only way to fully secure a file upload is to attempt parsing the uploaded file with PHP or some other extension/tool that expects a specific valid file type. In other words:

• Images: use GD functions to parse the file, they'll return false if it isn't a valid image.
• Videos: could probably validate using ffmpeg on the command line and check the output or use the ID3 extension as suggested here: https://stackoverflow.com/a/134893 (credit to Zathrus Writer's comment on the question linking to this question)
• Documents: Attempt loading the file with PHPExcel/Word/PowerPoint although I'm not sure that these would support just any format of those documents as it works on OpenXML.

From looking at the getID3 extension this might be the best bet as it seems to parse a wide variety of content types.

In any case, what you essentially need is for PHP or some other 3rd party library/extension to determine that the binary data of a file corresponds with its MIME content type.

Hope this helps :)