Mime Type vs Extension Check, which method is better to check file type?

Question

I'm creating a script to upload image file. There are two ways to verify if the file is an image.

First one is by checking the extension:

$extension = strtolower(substr($filename, strrpos($filename, '.') + 1, strlen($filename) - strrpos($filename, '.')));
if ($extension == "jpg") // UPLOAD

Another one is by checking the mime type:

$imageinfo = getimagesize($filename);
if ($imageinfo['mime'] == "image/jpeg") // UPLOAD

Which one is the better method to verify if the file is an image?

Fair enough. But I want to know which one of these methods is better? — Trondro Mulligan, Jan 14 '17 at 18:21
Both are not that reliable. You might want to look at the PHP Fileinfo module. Though stil not 100% reliable. — frz3993, Jan 14 '17 at 18:26
If you want to make sure the file is an image using a library like Imagick is more reliable I think — frz3993, Jan 14 '17 at 18:32
Both can easily be forged, so neither is really better or worse — Mark Baker, Jan 14 '17 at 20:43

score 1 · Accepted Answer · edited May 23 '17 at 12:10

1

Use the first one, because not every MIME type has a fixed file extension. Also, MIME types like application/octet-stream can refer to multiple file extensions. and also you can use pathinfo() for getting file extension.

check below links

How to extract a file extension in PHP?

Not every MIME type has a fixed file extension...

edited May 23 '17 at 12:10

Community

1
1

answered Jan 14 '17 at 19:47

msk

481
2
12

Mime Type vs Extension Check, which method is better to check file type?

1 Answers1