Check file type?

Question

I need to check a file's type on upload to make sure it's an image. What I'm thinking of doing is checking the MIME file type(from $_FILE ) and then checking that against the extension. Something like:

function checkType($file){

    $ext = pathinfo($_FILES[$file]['name'], PATHINFO_EXTENSION);
    $mime = $_FILES[$file]['type'];

    if($mime == "image/jpg" || $mime == "image/jpeg"){

        if($ext == "jpg" || $ext == "jpeg"){
            return true;
        } else{
            return false;
        }

    }

    if($mime == "image/gif"){

        if($ext == "gif"){
            return true;
        } else{
            return false;
        }

    }

    if($mime == "image/png"){

        if($ext == "png"){
            return true;
        } else{
            return false;
        }

    }

}

Is this a good approach? Suggestions?

Also, how would I go about getting the width of the image before it's finally uploaded to the server?

Answer 1

You should never rely on the content type provided by $_FILE as it's set by the browser, not by your server.

If you're expecting images, you should use getimagesize() to get the type of the image.

Example:

$imagedata = getimagesize($_FILES['image']['tmp_name']);
$mime = $imagedata['mime'];

You should then make sure that $mime isn't empty and that it contains a mime type that you want.

Here's an example using the Google logo: http://codepad.viper-7.com/9GBDf9

Answer 2

No, its bad. Mime type could not match actual file contents. To be sure what kind of uploaded file you received (or if its actually an image) you need to check file contents.

Try function like getimagesize for example. If it will return valid data then you have an image.