Uploading images

[carole2]

I was wondering if checking the mime type was enough to ensure that no malicious executable files are uploaded to the upload directory.

if(($FILES["inputFile"]["type"] == 'image/jpg') OR ($FILES["inputFile"]["type"] == 'image/gif'))
{

Or should the getimagesize("file.jpg") also be included to check to make sure its an image file.

The reason for the question is that if i also use the getimagesize function to check for image files, then i have to turn off hot linking protection(which prevents url access to images on your site), because the getimagesize function requires url access to images.

Thanks carole

[Kudose]

This would be sufficient:

$filetype = $_FILE['myFile']['type'];
if(($filetype == "image/jpeg") || ($filetype == "image/gif")){
//upload
} else {
echo "Error, ".$filetype." not permitted."
}

[Kudose]

Here, you can have a copy of the script I made for one of my sites.

function upload($myfile){
//declare constants
$dir = "/home/username/public_html/";
$file_name = $_FILES['myfile']['name'];
$file_type = $_FILES['myfile']['type'];
$file_size = $_FILES['myfile']['size'];
$max_size = 10240000;
$allowed_types = array("image/gif", "image/jpeg", "image/pjpeg", "image/bmp", "application/octet-stream", "text/plain", "application/x-zip-compressed", "application/vnd.ms-excel", "audio/mpeg", "audio/midi", "application/msword"); 

//make sure everything is fine
if($file_size >= $max_size){ echo "File is too big. Maximum size is $max_size. Your file size was $file_size."; exit(); }
if(!in_array($file_type, $allowed_types)){ echo "File type is not allowed.<br><br>Allowed types are:<br>". sort($allowed_types) ."<br><br>Your file type was: $file_type"; exit(); }
if(copy($myfile, $dir.$file_name)){ echo "Your file was uploaded.<br><br>"; } else { echo "There was an error uploading your file.<br><br>"; }
//end
}