Validate whether image, after file upload

[hsriat]

[PHP]if (!($_FILES['image']['type'] == "image/gif" || $_FILES['image']['type'] == "image/jpg" || $_FILES['image']['type'] == "image/jpeg" || $_FILES['image']['type'] == "image/png"))
die ('Invalid File Type');[/PHP]
This displays error when a file other than image file is uploaded.
But if someone manually changes the mime type, say from .xcf to .png, then this doesn't help.

How can I restrict that?

[ronverdonk]

What I always have used, but I don't know if it is foolproof, is doing a [php]list($width, $height) = getimagesize($filein);[/php]most non-images, like code, return no width and no height. But, be aware, I have not tested this with more than a couple of file types, so I am not at all sure if there are any other non-image file types, that do return width and height.

Ronald

[hsriat]

Means there is no actual way to find out the file type if messed with the extension.

I have added this to my code, but it will return height and width for other image types also. like tif, jpc etc.

Thanks :)

Harpreet


PS: What's wrong with your Avatar? Can you see it on your browser?

[ronverdonk]

Yes, I know it is not foolproof, but until now it is the only check I have.

My avatar is fine. Have been using it for almost 2 years now and no complaints.

Ronald

[hsriat]

Yes, I know it is not foolproof, but until now it is the only check I have.

My avatar is fine. Have been using it for almost 2 years now and no complaints.

Ronald

Ok, may be there's problem with my browser. Neither your avatar is visible in the contributors list nor near your name. Is written ronverdonk's avatar. Its been like that for the last two days. So I thought of telling you.


Harpreet

[ronverdonk]

Thanks, I'll look into it.

Ronald

[hsriat]

Hi,

While I was searching something on php.net, I found this, exif_imagetype.

This is quite useful for such situations.

Harpreet

[ronverdonk]

Thanks for that information. I can certainly use that.

Ronald

[hsriat]

Thanks for that information. I can certainly use that.

Ronald

Even I want to use it but my WAMP (PHP 5.2.5) says Call of undefined function exif_imagetype()
What can I do with this now? Any idea?

[ronverdonk]

Well I have the same problem. But searching a bit further, I see that the getimagesize() function gives that result also.

In index 2 of the result is the imagetype, identical to the number in exif..().

Ronald

[hsriat]

Well I have the same problem. But searching a bit further, I see that the getimagesize() function gives that result also.

In index 2 of the result is the imagetype, identical to the number in exif..().

Ronald

You are right, 1 is for gif, 2 is for jpg, 3 for png and 7 for tif.
I didn't have any other formats, so could not check.

Apart from that, the mime index actually returns the file type, even if extension is fake. Good information for me.

Thanks

Harpreet

[hsriat]

My avatar is fine. Have been using it for almost 2 years now and no complaints.

Ronald

Now I know why I can't see your Avatar sometimes.
While I was working on different image formats, I tried displaying a jpg on the browser after changing its extension to gif.
It gave error sometimes (1 out of 10 tries).

Your Avatar is saved in theScripts as gif, while its a jpg image.

Harpreet

[ronverdonk]

But my avatar is a jpg. Are you telling me they changed it to gif when saving?

Ronald

[hsriat]

But my avatar is a jpg. Are you telling me they changed it to gif when saving?

Ronald

No they didn't convert it, but just changed the extension.
Right click on your avatar and save it. It will tell you that its actually jpg but name says its gif

[ronverdonk]

You are right. I'll change mine to gif and upload it.

Ronald

[hsriat]

You are right. I'll change mine to gif and upload it.

Ronald

Yeah, you may.
Even mine was PNG, and I changed it to GIF. See now its only visible near my name, but not in the contributors list :D. This is because, they don't link to the latest Avatar in the contributors list. That will be changed when the contributor's list will get updated next time. You can see it still refers to the old serial number, while one in the forum refers to the new serial number.

Have a good luck!

Harpreet