- Validate MIME types with PHP Fileinfo
- Verifying mime type of pdf files on upload in PHP
- Verifying mime type of pdf files on upload in PHP
- How to check mime type and upload in different dir
- How to check mime type of file uploaded image
- Работа с MIME-типами в PHP
- Как узнать MIME-тип загруженного файла
- Результат:
- Отправка файлов из PHP
Validate MIME types with PHP Fileinfo
How to check the file type in PHP and secure file uploads: it is important to validate MIME types in PHP. Especially of files uploaded through an upload form to your website. Using PHP, the best way to validate MIME types is with the PHP extension Fileinfo. Any other method might not be as good or secure as you might think…
PHP file input validation, The old^Wwrong way
It is quite common to only look at the file extension to determine what type of file it is (I was hoping to say “years and years ago”, but unfortunately I still see this on a regular basis…).
An image always has an extension like .jpg, .jpeg, .png or .gif, right? And a Portable Document Format is the only file type to use .pdf as extension. Oh we were wrong!
To validate a file’s extension, we used to use something in the line of:
if(eregi("\.jpg|\.jpeg|\.gif|\.png|\.bmp", $_FILES['userfile']['name']) != FALSE) < // do stuff // some more . > Code language: PHP (php)and whether this example uses ereg , eregi or preg_match doesn’t matter. Seeing an extension like jpg, jpeg, gif, png or bmp made sure these are only images, right? Not!
Some of us might expanded the validation of PHP uploaded files with an extra check:
PHP File Validation, A Better Way To Validate MIME Types , but only for images
A better way to validate MIME types in PHP is:
$imageInfo = getimagesize( $_FILES['userfile']['tmp_name'] ); if ($imageInfo['mime'] == ("image/png") || $imageInfo['mime'] == ("image/jpeg") || $imageInfo['mime'] == ("image/gif") || $imageInfo['mime'] == ("image/psd") || $imageInfo['mime'] == ("image/bmp")) Code language: PHP (php)This last check uses a PHP image function called getimagesize(). So this only works on images.
The getimagesize() function will determine the size of any given image file and return the dimensions along with the file type and a height/width text string to be used inside a normal HTML IMG tag and the correspondent HTTP content type.
But getimagesize() only works for images and fails on other file types. Therefore a lot of developers use (hopefully used to use?) mime_content_type() .
Well, let that function be deprecated in favor of the PECL extension Fileinfo . And on its turn, the PECL extension Fileinfo now is deprecated in favor of the PHP extension Fileinfo. Can you still follow?
So it is best to use the PHP extension Fileinfo, because it works for other file types than images too.
PHP Fileinfo extension: validate MIME types and secure file uploads in PHP
To properly validate MIME-types in PHP, in order to provide some sort of file upload security, you need to use PHP Fileinfo functions. This can validate Office MIME types and others.
An example PHP function to validate Office and PDF MIME types is:
/* * Follow me on Twitter: @Jan_Reilink, https://twitter.com/hertogjanr */ function check_doc_mime( $tmpname ) < // MIME types: http://filext.com/faq/office_mime_types.php $finfo = finfo_open( FILEINFO_MIME_TYPE ); $mtype = finfo_file( $finfo, $tmpname ); finfo_close( $finfo ); if( $mtype == ( "application/vnd.openxmlformats-officedocument.wordprocessingml.document" ) || $mtype == ( "application/vnd.ms-excel" ) || $mtype == ( "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet" ) || $mtype == ( "application/vnd.ms-powerpoint" ) || $mtype == ( "application/vnd.openxmlformats-officedocument.presentationml.presentation" ) || $mtype == ( "application/pdf" ) ) < return TRUE; > else < return FALSE; > > if( function_exists( "check_doc_mime" ) ) < if ( !check_doc_mime( $_FILES['userfile']['tmp_name'] ) ) < /* * Not a MIME type we want uploaded to our site, stop here * and return an error message, or just die(); */ > else < /* * a MIME type we support is uploaded. Continue with our * upload script */ > > /* Support https://www.paypal.me/jreilink , thank you! */ ?>Code language: PHP (php)This function can be used to verify the MIME type of files uploaded through HTTP $_POST . Proper user input validation is important for your website security!
Verifying mime type of pdf files on upload in PHP
I am using PHP 5.2.5 and can't seem to get fileinfo or mime_content_type() working. for fileinfo i keep getting this: Solution 1: mime types are not reliable for checking type of files. I am already checking file extension but i want to make sure the file really is a pdf file.
Verifying mime type of pdf files on upload in PHP
I am working on a project that requires file uploads. I want to make sure it's secure and that only PDF files are being uploaded. I am already checking file extension but i want to make sure the file really is a pdf file .
What is the best way to check the mime type in php? I am using PHP 5.2.5 and can't seem to get fileinfo or mime_content_type () working.
for fileinfo i keep getting this:
Warning: finfo_open() [function.finfo-open]: Failed to load magic database at '(null)'. in [snipped filename] on line 35 mime types are not reliable for checking type of files. A client's browser might report it wrongly.
Check for Magic Number. PDF files start with "%PDF" (25 50 44 46).
Indeed, MIME type's aren't the best way of making sure that a user has uploaded a valid file since this can be easily faked if you know how.
But when the file is being posted, you can always check the mime type this way:
Maybe you could use a php class to determine it's a valid pdf something like FPDF( http://www.fpdf.org/)
It probably means that the MAGIC environment variable is not set, and your magic file isn't at /usr/share/misc/magic . Either set the value of MAGIC to point to the correct magic file, or pass the magic file as a second parameter to your finfo constructor
$finfo = new finfo(FILEINFO_MIME, "/usr/share/misc/magic"); $finfo = finfo_open(FILEINFO_MIME, "/usr/share/misc/magic"); An easy way to get the MIME type is directly from $_FILES. If the mime type contains the word 'pdf' then you can consider it a valid PDF .
$contentType = $_FILES['myFile']['type']; if(isValidPDF($contentType)) < die('It is a PDF'); >else < die('It is not a PDF'); >function isValidPDF($mime) PHP: How to properly check MIME type of a file?, To get MIME type, developers generally depend on $_FILES['input_name']['type'].But this is absolutely vulnerable. Because a malicious user can set one of image/jpg, image/png, image/gif etc. MIME types to a file that is not actually an image. In that case, the malicious user may get your script pass … Code sample$mime_type = mime_content_type($_FILE['input_name']['tmp_name']);$allowed_file_types = ['image/png', 'image/jpeg', 'application/pdf'];if (! in_array($mime_type, $allowed_file_types)) <>$destination = '/path/to/move/your/file/';Feedback
How to check mime type and upload in different dir
private $uploadhost = "http://my.domain.com/"; function upload() < date_default_timezone_set('Europe/Berlin'); $key = "mykey"; $redirect = "http://domain.com"; $Date = date("Y-m-d_H-i-s"); if ($_SERVER["REQUEST_URI"] == "/robot.txt") < die("User-agent: *\nDisallow: /"); >if ($this->input->post('key')) < if ($this->input->post('key') == $key) < $target = getcwd() . "/r/" . basename($_FILES['file']['name']); if (move_uploaded_file($_FILES['file']['tmp_name'], $target)) < $filename = explode(".", $_FILES["file"]["name"]); $filename = $filename[sizeof($filename) - 1]; rename($target, getcwd() . "/r/" . md5($Date) . "." . $filename); echo $this->uploadhost . "up/" . md5($Date) . "." . $filename; > else < echo "Something went wrong"; >> else < header('Location: ' . $redirect); >> else < header('Location: ' . $redirect); >> my script from above is working only with images. I want to use it for files like *.exe for downloading after upload. How can I check myme type of file and upload file into different directory. So images are going to /r and files are going to /d and .txt is going to /t like this.
Im working with codeigniter 3 RC and ShareX.
Please guide with url https://www.codeigniter.com/user_guide/libraries/file_uploading.html to upload mime type in codeigniter
How to get the mime content type from 'php://input' in PHP, The images are dropped on an area, and then, have to be automatically saved on server. Images are send throw an AJAX request. I would like to check the mime type from the server side to be sure I will not save anything unsafe.
How to check mime type of file uploaded image
I'm trying to check the mime type of an image. This is my code:
private function checkMIMEType() < $finfo = new finfo(FILEINFO_MIME_TYPE); $this->_dataArray['ext'] = array_search( $finfo->file($this->_dataArray['tmp_name']), $this->_mimeArray, true ); if($this->_dataArray['ext']===false) < $this->error = "File not supported"; return false; > else < return true; >> This is the error: Warning: require_once (classes/finfo.php): failed to open stream: No such file or directory in D:\XAMPP\htdocs
What I've got from now on is from this site: http://php.net/manual/en/class.finfo.php
And I think It's because I have a wrong version of the PHP because I wrote this online works with php > 5.3.0
Is there any way this code can run with a later version? Or is there something wrong with my code?
You're right on the money- this was introduced in PHP 5.3.0, so any older version will not have this class defined.
However, this class was a package before it was incorporated into PHP. You can get it from here: https://pecl.php.net/package/Fileinfo
PHP file upload: mime or extension based verification?, In order to accurately determine what has been uploaded, you don't check for the file extension nor for the mime type sent by If you accept HTTP request with filename "image.php" and mime-type "image/gif" and save to public directory on HDD file "image.php" (with .php extension), apache will be handle …
Работа с MIME-типами в PHP
«Internet Media Types» или «Медиа типы» — является стандартом RFC 6838, который описывает формат файла. Причем браузеры используют MIME-типы в качестве основного критерия, не воспринимая расширения файлов.
MIME-тип состоит из типа и подтипа — двух значений разделённых « / », без использования пробелов и в нижнем регистре, например HTML страница:
Полный список MIME типов можно посмотреть тут.
К медиа типу может быть добавлен параметр для указания дополнительных деталей (например кодировка):
Как узнать MIME-тип загруженного файла
При загрузке файла через форму, MIME-тип файла доступен в массиве $_FILES , например:
Для определения MIME уже загруженного файла существует PHP-функция mime_content_type().
echo mime_content_type(__DIR__ . '/image.png'); // image/png echo mime_content_type(__DIR__ . '/text.txt'); // text/plainПри работе с изображениями, MIME-тип можно получить с помощью функции getimagesize():
$filename = __DIR__ . '/image.png'; $info = getimagesize($filename); print_r($info);Результат:
Array ( [0] => 221 [1] => 96 [2] => 3 [3] => width="221" height="96" [bits] => 8 [mime] => image/png )Важно помнить что при проверке файлов нельзя полагаться только на проверку MIME, т.к. его значение может быть скомпрометировано. Поэтому нужно проводить более детальную проверку (например по размеру изображения или его пересохранить в предполагаемом формате).
Отправка файлов из PHP
В PHP-скриптах, перед отправкой файлов клиенту, необходимо отправлять заголовок Content-Type , например файл XML:
$content = '. '; header("Content-Type: text/xml; charset=utf-8"); echo $content; exit();$file = ROOT_DIR . '/market.zip'; header('Content-type: application/zip'); header('Content-Transfer-Encoding: Binary'); header('Content-length: ' . filesize($file)); header('Content-disposition: attachment; filename="' . basename($file) . '"'); readfile($file); exit();Вывод изображения в зависимости от расширения файла:
$filename = __DIR__ . '/image.png'; $ext = mb_strtolower(mb_substr(mb_strrchr($filename, '.'), 1)); switch ($ext) < case 'png': header('Content-type: image/png'); break; case 'jpg': case 'jpeg': header('Content-type: image/jpeg'); break; case 'gif': header('Content-type: image/gif'); break; case 'wepb': header('Content-type: image/webp'); break; >readfile($filename); exit();