Server side validation of image upload

jgroebucl

Hi,

I have a PHP script that is supposed to check and validate the file type and size of a file if a user chooses to upload an image through a contact form. It is then sent my e-mail which I can view.

It works fine but it doesn't seem to impose the restrictions of file type or size and I also intended the image upload to be optional so that the contact form validates if a user chooses not to upload an image file, but the form won't validate if a file (of any size or type) is uploaded.

Here is the script:

	//check file size

if($_FILES['file']['size']/1024 > 250000) $alert .= "<li>File size is too large</li>";



//check file type

$fileType="";

if(strstr($_FILES['file']['type'],"jpeg")) $fileType="jpg";

if(strstr($_FILES['file']['type'],"png")) $fileType="png";

if(strstr($_FILES['file']['type'],"gif")) $fileType="gif";



if (!$fileType) $alert .= "<li>Invalid file type!</li>";





//If the user err'd, print the error messages.

if ( $pass==1 ) {



	//This first line is for ajax/javascript

echo "<script>$(\".message\").hide(\"slow\").show(\"slow\"); </script>";
echo "<b>" . $errormessage . "</b>";
echo "<ul>";
echo $alert;
echo "</ul>";



// If the user didn't err and there is in fact a message, time to email it.

} elseif (isset($_REQUEST['email'])) {



    //upload file to folder

	//generate random prefix

	$prefix="";

    $j=1;

    While ($j<=11)

    {

    $randomposition=rand(0,9);

    $prefix = $prefix . $randomposition;

    $j=$j+1;

    }



	//upload and rename file

	move_uploaded_file($_FILES['file']['tmp_name'],"uploads/".$prefix."_".basename($_FILES['file']['name']));



	//get uploaded file and send with email

	$filePath = basename( $_FILES['file']['name']); 		



	// send email

require 'sendmail/class.phpmailer.php';

Can anyone see where why it's not working? Any help at all is greatly appreciated.

Thanks

bradgrafelman

As for file "type", note that the 'type' in the file upload array is supplied by the user's browser, so I could just upload "my_new_awesome_trojan.exe" to your servers and claim it is a "image/gif" and your script would be none the wiser. If you want to actually read the binary data and attempt to parse it as an image, you might try looking at [man]getimagesize/man. Other alternatives might include using [man]mime_content_type/man or the [man]Fileinfo[/man] extension.

As for file size, your script is only limiting file uploads above 244 MB (and some change), so.. are you testing this by uploading a file over 244 MB?