我该如何检查上传文件的类型是安全的

Question

In php manual said that $_FILES['userfile']['type'] is under control of the client(so maybe it can be edited,I guess).

php manual.

$_FILES['userfile']['type']
The mime type of the file, if the browser provided this information.
An example would be "image/gif".
This mime type is however not checked on the PHP side and therefore don't take its value for granted.

and this:

You could use the $_FILES['userfile']['type'] variable to throw away any files that didn't match a certain type criteria, but use this only as first of a series of checks, because this value is completely under the control of the client and not checked on the PHP side.

So how can I check the type of uploaded file for preventing the harmful file to be uploaded?

Answer 1

As you've discovered for yourself, you should thoroughly check each file to avoid security issues.

Mostly it depends on what kind of files you want to allow. I'd go with these two steps:

1. Check the content type.

Nothing to add here, you've already posted the way to do it in your question. However, this can be faked, so please don't forget to ....

2. Verify the file content.

You should carefully check the files content. If you're dealing with images, you can use phps image functions to be on the safe side.

Example:

$x = getimagesize($_FILES['uploadfile']['tmp_name']);
if (isset($x)) {
    if($x['mime'] != 'image/gif' && $x['mime'] != 'image/jpeg') {
        echo 'Not a valid GIF or JPEG';
        exit(0);
    }
}