Internet Explorer文件上传无法通过MIME类型检查

Question

I have cobbled together some scripts from various internet sources to get a form working. I have run into an issue that I can't solve. The form I created allows the user to submit their data in fields, plus an image attachment (validation: .EPS or .JPG format).

The script works fine in Firefox and Safari, but not in Internet Explorer. In IE, whether or not you attach an image of the correct type, it returns the error for incorrect file type. So for some reason it seems IE is not validating the file type as the PHP is asking it to do.

<?php
/* ....
   snip
   .... */
      $filetype=$_FILES["prosp_client_logo"]["type"];
/* ....
   snip
   .... */
      elseif($filetype=="application/postscript" or $filetype=="image/jpg" or $filetype=="image/jpeg") {
/* ....
   snip
   .... */
?>

Please let me know if you need any clarification.

Answer 1

http://www.php.net/manual/en/features.file-upload.php#75932

Richard Davey rich at corephp dot co dot uk 22-Jun-2007 12:05
[...] you may be inclined to validate an update based on its reported mime-type from the $_FILES array. However be careful with this - it is set by the browser , not by PHP or the web server, and browsers are not consistent (what's new?!)

IE will send its own mime-type (based on its filesystem association) for the attachment, which can often be different than what you're expecting in your code. This data can also be spoofed, so it's best not to trust what the browser says about the file's mime-type .

Also:

http://www.php.net/manual/en/features.file-upload.php#53133

keith at phpdiary dot org 24-May-2005 11:14
[...] My best bet would be for you to check the extension of the file and using exif_imagetype() to check for valid images. Many people have suggested the use of getimagesize() which returns an array if the file is indeed an image and false otherwise, but exif_imagetype() is much faster. (the manual says it so)