secure file upload

[picokojama]

Hi there,

 

I know how to secure file upload by checking file extension, but how can I secure from files that looks like images(have .jpg extension), but they are something else, like .exe file with .jpg extension (don't know for mac and ubundu, but you can do that trick on windows)

 

Thanks advanced

[justsomeguy]

If your server supports fileinfo then you can use that to get the mime type:

 

http://www.php.net/manual/en/function.finfo-file.php

 

The MIME type isn't a guarantee though, one option for images specifically is to use one of the imagecreate functions to try and create an image from the file and see if there's an error. Check the comments on the link above.

[picokojama]

Well, method is good enaught...

I just found extra level of security, disablad php from running in directory with .htaccess

 

Thanks