Php file image upload security

Question

$filename=$_FILES['file']['name'];
$type=$_FILES['file']['type'];
$extension=strtolower(substr($filename, strpos($filename, '.')+1));
$size=$_FILES['file']['size'];


if(($extension=='jpg' || $extension=='jpeg') && ($type!='image/jpg' || $type!='image/jpeg')){...

I have a input file, can let user upload jpg/jpeg image only, I have check type, extension, size.

However I'm not sure how to check if user change extension.(ex. abc.php -> abc.jpg)
any thing else I need to check before I save user's image into my server?

@deceze this one is more image specific. there are many php functions that are unique to this question, ie exif_imagetype() and imagejpeg() which should be uniquely beneficial to this situation. — XaxD
– XaxD, Commented Aug 7, 2013 at 15:18
thx for help, I think i will use all function to check, in case anything happen, looks like there are more articles need to read... — Ben
– Ben, Commented Aug 7, 2013 at 15:24

Fabian · Accepted Answer · 2013-08-07 15:01:47Z

3

You can check the image with exif_imagetype()

http://www.php.net/manual/en/function.exif-imagetype.php

exif_imagetype() reads the first bytes of an image and checks its signature.

edited Aug 7, 2013 at 15:01

answered Aug 7, 2013 at 14:56

Fabian

3,4954 gold badges37 silver badges43 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Jake Aitchison · Accepted Answer · 2013-08-07 14:56:20Z

2

I would suggest using finfo:

<?php
    $finfo = finfo_open(FILEINFO_MIME_TYPE); // return mime type ala mimetype extension
    foreach (glob("*") as $filename) {
        echo finfo_file($finfo, $filename) . "\n";
    }
    finfo_close($finfo);

    /* outputs:
    text/html
    image/gif
    application/vnd.ms-excel
    */
?>

example taken from php document site. see more info on the php document page http://www.php.net/manual/en/function.finfo-file.php

answered Aug 7, 2013 at 14:56

Jake Aitchison

1,1096 silver badges20 bronze badges

2 Comments

Katana314 Over a year ago

Does this read the MIME type from the file itself somehow, or from the user's Content-Type header?

Jake Aitchison Over a year ago

@Katana314 Yes from the byte sequences at specific positions within the file please check php.net/manual/en/intro.fileinfo.php :D and its requirements: php.net/manual/en/book.fileinfo.php

hungerstar · Accepted Answer · 2013-08-07 15:15:25Z

0

@Fabian's answer looks good for checking the type of file. While I would suggest a different approach to getting the extension of the file.

Consider a file named stack.overflow.jpg.

$filename = 'stack.overflow.jpg';

// With your code $extension = 'overflow.jpg'
$extension=strtolower( substr( $filename, strpos( $filename, '.' ) +1 ) );

// With pathinfo() $extension = 'jpg'
$extension = pathinfo( $filename, PATHINFO_EXTENSION );

Consider using pathinfo() to get the file extension: http://www.php.net/manual/en/function.pathinfo.php

answered Aug 7, 2013 at 15:15

hungerstar

21.8k6 gold badges52 silver badges63 bronze badges

3 Comments

XaxD Over a year ago

file extention means nothing though. I could name my malicious script keyloggervirus.exe.jpg and it would still execute. You need to use PHP to actually verify the image content, like the above answers do.

Ben Over a year ago

is any way to reformate file to jpg? so even its malicious script, it will become jpg

XaxD Over a year ago

php has imagejpeg()

Collectives™ on Stack Overflow

Php file image upload security

3 Answers 3

Comments

2 Comments

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

2 Comments

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related