PHP Uploading files - image only checking

Question

I have a simple PHP upload script I have started. I am not the best to PHP. Just looking for some suggestions.

I want to limit my script to only .JPG, .JPEG, .GIF and .PNG

Is this possible?

<?php
/*
    Temp Uploader
*/

    # vars
    $mx=rand();
    $advid=$_REQUEST["advid"];
    $hash=md5(rand);

    # create our temp dir
    mkdir("./uploads/tempads/".$advid."/".$mx."/".$hash."/", 0777, true);

    # upload dir
    $uploaddir = './uploads/tempads/'.$advid.'/'.$mx.'/'.$hash.'/';
    $file = $uploaddir . basename($_FILES['file']['name']);

    // I was thinking of a large IF STATEMENT HERE ..

    # upload the file
    if (move_uploaded_file($_FILES['file']['tmp_name'], $file)) {
      $result = 1;
    } else {
      $result = 0;
    }

    sleep(10);
    echo $result;

?>

cowburn.info/2008/01/13/get-file-extension-comparison - apparently strrchr is the fastest way — TheBlackBenzKid
– TheBlackBenzKid, Commented Feb 16, 2012 at 15:46

Community · Accepted Answer · 2018-11-03 07:26:15Z

49

Yes, quite easily. But first off, you need some extra bits:

// never assume the upload succeeded
if ($_FILES['file']['error'] !== UPLOAD_ERR_OK) {
   die("Upload failed with error code " . $_FILES['file']['error']);
}

$info = getimagesize($_FILES['file']['tmp_name']);
if ($info === FALSE) {
   die("Unable to determine image type of uploaded file");
}

if (($info[2] !== IMAGETYPE_GIF) && ($info[2] !== IMAGETYPE_JPEG) && ($info[2] !== IMAGETYPE_PNG)) {
   die("Not a gif/jpeg/png");
}

Relevant docs: file upload errors, getimagesize and image constants.

edited Nov 3, 2018 at 7:26

CommunityBot

11 silver badge

answered Feb 16, 2012 at 15:43

Marc B

362k44 gold badges433 silver badges508 bronze badges

Sign up to request clarification or add additional context in comments.

9 Comments

Surreal Dreams Over a year ago

Beat me to it - this method makes sure the file is an image, not just named like an image.

Mr Griever Over a year ago

The only caveat is that GD is not oob for PHP and can be finicky. finfo_file is standard in PHP after version 5.3.0 and will do a content-based check as well.

TheBlackBenzKid Over a year ago

How can I check the file resolution too? IE Size if width and height??

cottton Over a year ago

"Do not use getimagesize() to check that a given file is a valid image. Use a purpose-built solution such as the Fileinfo extension instead." See php.net/manual/en/function.getimagesize.php

SteppingHat Over a year ago

This is BAD and opens up your site to potential remote code execution. Anyone can put exactuable code inside the image header (where the metadata is stored and text is considered valid) and getimagesize will still think it is an image, thus accepting the file and potentially allowing PHP code to be executed server side. Use mime_content_type instead.

|

Community · Accepted Answer · 2012-02-16 17:41:56Z

6

File path isn't necessarily the best way to check if an image really is an image. I could take a malicious javascript file, rename it to have the .jpg extension, and upload it. Now when you try to display it in your website, I may have just compromised your site.

Here is a function to validate it really is an image:

<?php
  function isImage($img){
      return (bool)getimagesize($img);
  }
?>

edited Feb 16, 2012 at 17:41

CommunityBot

11 silver badge

answered Feb 16, 2012 at 15:43

Jeremy Harris

24.7k13 gold badges84 silver badges133 bronze badges

1 Comment

Tilak Madichetti Over a year ago

Do not use getimagesize() to check that a given file is a valid image. Use a purpose-built solution such as the Fileinfo extension instead.

- Docs

a77mp · Accepted Answer · 2018-02-12 09:23:30Z

5

try this:

<?php

function isimage(){
$type=$_FILES['my-image']['type'];     

$extensions=array('image/jpg','image/jpe','image/jpeg','image/jfif','image/png','image/bmp','image/dib','image/gif');
    if(in_array($type, $extensions)){
        return true;
    }
    else
    {
        return false;
    }
}

    if(isimage()){
        //do codes..
    }

?>

edited Feb 12, 2018 at 9:23

answered Feb 10, 2018 at 21:48

a77mp

771 silver badge4 bronze badges

2 Comments

Derek Brown Over a year ago

Your post was flagged as low quality because it was all code. Try explaining what you did.

Humphrey Over a year ago

This was my easiest and worked

tvgemert · Accepted Answer · 2012-02-16 15:39:48Z

-1

Or take a look at: http://php.net/manual/en/function.pathinfo.php

answered Feb 16, 2012 at 15:39

tvgemert

1,4863 gold badges25 silver badges50 bronze badges

Comments

JH_ · Accepted Answer · 2018-11-17 17:25:18Z

-3

if (substr($_FILES["fieldName"]["name"], strlen($_FILES["fieldName"]["name"])-4) == ".jpg")
{
    if(move_uploaded_file($_FILES["fieldName"]["tmp_name"],$path."/".$_FILES['fieldName']['name']))
    {
        echo "image sucessfully uploaded!";
    }
}

similarly you can check for other image formats too.

edited Nov 17, 2018 at 17:25

JH_

4061 gold badge4 silver badges16 bronze badges

answered Feb 16, 2012 at 15:39

dee

1947 bronze badges

1 Comment

Marc B Over a year ago

You're assuming the remote user is not malicious and won't just rename nastyvirus.exe to cutekittens.jpg.

Collectives™ on Stack Overflow

PHP Uploading files - image only checking

5 Answers 5

9 Comments

1 Comment

2 Comments

Comments

1 Comment

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

5 Answers 5

9 Comments

1 Comment

2 Comments

Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Linked

Related