(PHP) How can I validate the .svg (file upload)

Question

I have a problem validating a file upload.

To be sure a user uploads a valid image (not a file with extension .jpg or .png,...) one can use getimagesize(). For example: W3school .

But what about an .svg file? The function getimagesize() returns nothing when I use print_r(). How could I be sure that user uploads a .svg file, not a file with extension .svg (virus.svg)?

https://stackoverflow.com/questions/9651493/validating-svg-file-in-php-with-xmlreader — Gavindra Kalikapersaud, Feb 18 '18 at 19:47
Possible duplicate of [Validating SVG file in PHP with XMLReader](https://stackoverflow.com/questions/9651493/validating-svg-file-in-php-with-xmlreader) — Gavindra Kalikapersaud, Feb 18 '18 at 19:47
@gkalikapersaud Thanks but it's not. They have the file path. I don't. I use ``. And because some reasons, the browsers don't let me get the full path or I don't know how to get it. — Minh Luân Vũ, Feb 19 '18 at 01:46
Ok, I'll check it with [javascript](https://stackoverflow.com/questions/18299806/how-to-check-file-mime-type-with-javascript-before-upload) — Minh Luân Vũ, Feb 19 '18 at 04:30

dearsina · Answer 1 · 2021-06-28T03:19:06.987

If you're OK with using external scripts, you can use the SVG Sanitize package: https://packagist.org/packages/enshrined/svg-sanitize

While its primary purpose is sanitation, as a by-product of that process, it will also ensure your SVG is valid.

use enshrined\svgSanitize\Sanitizer;

// Create a new sanitizer instance
$sanitizer = new Sanitizer();

// Load the dirty svg (if it's an SVG file)
$dirtySVG = file_get_contents('filthy.svg');

// if it's a base64 encoded string, you can alternatively use the following
$base64_str = str_replace('data:image/svg+xml;base64,', '', $b64_string);
$base64_str = str_replace(' ', '+', $base64_str);
$dirtySVG = base64_decode($base64_str);

// Pass it to the sanitizer and get it back clean
if(!$cleanSVG = $sanitizer->sanitize($dirtySVG)){
    //if this fails, the SVG was not valid.
}

// Now do what you want with your validated and clean SVG/XML data

(PHP) How can I validate the .svg (file upload)

1 Answers1