Extension validation in php

Question

I've been trying and retrying at this code trying to get the file extension and conditionally check against it, but due to the files placement in flow I can't see what's going into $ext.

Can anyone pinpoint what is going wrong here? It's just manipulating the uploads file for dropzone.js.

if (!empty($_FILES)) {

    $tempFile = $_FILES['file']['tmp_name'];          //3             

    $targetPath = dirname( __FILE__ ) . $ds. $storeFolder . $ds;  //4

    $targetFile =  $targetPath. $_FILES['file']['name'];  //5

    $ext = end(explode(".", $_FILES['file']['tmp_name']));

    if(filesize($tempFile) < 6000000 and $ext == "png"){
        move_uploaded_file($tempFile,$targetFile); //6
    }

}

I'm not sure what you mean by "due to the files placement in flow" — Kmeixner, Jun 15 '15 at 17:05
dont base this all on the file extension. I could rename a php file to png, upload it, and then possibly run it from your uploads directory. find out the mimetype and then validate using that. http://stackoverflow.com/questions/23287341/how-to-get-mime-type-of-a-file-in-php-5-5 — castis, Jun 15 '15 at 17:10

Surbhi · Answer 1 · 2015-06-20T17:35:45.297

You are using tmp_name variable to get extension which will always give you file with .tmp extension.

In place of

$ext = end(explode(".", $_FILES['file']['tmp_name']));

Use this :

$ext = end(explode(".", $_FILES['file']['name']));

Update :- But it is better to validate the file type by checking its mime time(as said by @castis), as some user might rename its file with some extension and upload it.

Below is a code sample to validate a text file, you can use similar method to validate image type.

$file_type =  mime_content_type($_FILES['img']['tmp_name']);

if($file_type == 'text/plain'){
    echo "file type is text";
}
?>

<form action="#" method="post" enctype="multipart/form-data">
  <input type="file" name="img">
  <input type="submit" value="Submit">
</form>

Also you can find file extenstion using $ext = pathinfo($_FILES['file_name']['name'],PATHINFO_EXTENSION); — Surbhi, Jun 15 '15 at 17:54

Extension validation in php

1 Answers1