eregi() to stop wrong file type uploads

Anon

Hi and thanks in advance for any help you can offer.

I have a file upload script up and running fine. But now I want to limit uploads to graphics only (jpeg, gif, png, bmp). The upload form includes [input=FILE name=image] and [input=text name=image_caption]. Here's what I've got so far, but it's not working at all:

// Check whether a jpeg, bmp, gif or png file is being uploaded
if ($image) {
if (!eregi("(.+.jpg)|(.+.jpeg)|(.+.gif)|(.+.bmp)|(.+.png)", $image)) {
include("error.php");
echo("");
print ("Wrong File Type: The image file that you are attempting to upload is the wrong file type. Only image files ending with the following extensions (lower-case or upper-case) are allowed: .jpg, .gif, .bmp, .png. Please ensure that your file is one of these file types and <a href=\"javascript:history.go(-1)\">return to the form</a> to try your upload again.");
echo("</body>");
exit;
}
}

I have another error handler running in the same script that checks if a file exists on the server or not, and prompts the user to try again with a different file name. This is working just fine:

if (file_exists("images/$image_name")) {
	echo("<font face=\"Verdana, Arial, Sans-Serif\" size=\"-1\">");
	include ("error.php");
	echo("<b>File Already Exists:</b><br><br>The file you are trying to upload has the same name as a file that already exists on the web server.  Please rename your file and then <a href=\"javascript:history.go(-1)\">return to the previous form</a> to attempt your upload again."); 
	echo("</font></body>");
	exit;
}

So I'm wondering what's wrong with the graphics-only error handling, and also when this check should occur - before or after the file_exists() check.

Any help is greatly appreciated!

Anon

In your regex, try changing the $image variable to $image_name.

Anon

And I'd change the regexp itself to

.(jpg|jpeg|gif|bmp|png)[[:>:]]

Or use nicer-looking preg_* functions

preg_match("/.(jpg|jpeg|gif|bmp|png)$/i",$image_name)

Anon

I forgot to say why. One reason is aesthetics. The other reason is that you can extend it to say

preg_match("/.(jpg|jpeg|gif|bmp|png)$/i",$image_name,$extension)

and $extension[1] will then be the filename extension, should that be useful later; save having to do another match.