verify mime type of upload file (non-image)

[jazz_snob]

In light of recent security concerns over PHP I've become extra paranoid. I was going to let users upload a CSV of their data for importing (eg: mailing list addresses) but I can't think of a way to verify that the uploaded file is actually a text file, or what the repercussions might be of trying to open a file of unknown type and trying to read it as CSV. Any ideas?

[MarkR]

Trying to read it as a CSV when it isn't will probably result in junk data. Your loader should have considerable checks in place to detect errors in the file- which means that someone uploading junk data will be detected early.

Some "Bad things" could happen if the file is too large or has excessively long lines in it - you may wish to check this before trying to parse it.

Personally I've only really ever developed applications which allow already-trusted users to do uploads (not anonymous ones).

Checking for obvious errors is always good. My recommendation is that you read the entire file and check it for validitiy before processing any of it, to avoid problems of partially loaded data.

Mark

[NogDog]

If using fgetcsv(), you probably should always set the second parameter to some reasonable maximum line length, so that if the user uploads some huge file with no line breaks you don't try to read it all as one line (and possibly run out of allocated memory).