PHP check if uploaded file is an image

Question

I'm trying to create user avatars. I'm just trying to make sure its secure. What is the best way to check if the file is an actual image, and not anything else.

I've tried this

$check = getimagesize($_FILES["fileToUpload"]["tmp_name"]);
    if($check !== false) {
        echo "File is an image - " . $check["mime"] . ".";

    } else {
        echo "File is not an image.";
    }

Although this seems to work on some images, but other images like photos seem to make it fail. Photos that i've taken with my phone seem to make it appear with "File is not an image" while others make it appear with an image.

I've also been checking the file formats

if($imageFileType != "jpg" && $imageFileType != "png" && $imageFileType != "jpeg"
&& $imageFileType != "gif" ) {
    echo "Sorry, only JPG, JPEG, PNG & GIF files are allowed.";

}

you have $imageFileType=$_FILES["fileToUpload"]["type"] .

Hikmat Sijapati
– Hikmat Sijapati

2017-01-26 04:11:24 +00:00
Commented Jan 26, 2017 at 4:11 — Hikmat Sijapati
– Hikmat Sijapati, Commented Jan 26, 2017 at 4:11

Bedo · Accepted Answer · 2017-01-26 04:18:13Z

2

You can use the php5 function

mime_content_type ( string $filename )

Php doc here: http://php.net/manual/fr/function.mime-content-type.php

This will return, for example, "image/jpg". Parse the result, and voilà! This way you don't have to go through all the different types.

answered Jan 26, 2017 at 4:18

Bedo

361 silver badge5 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

user4395445 · Accepted Answer · 2017-01-26 04:17:00Z

0

You can use getimagesize() directly and it will return zero value for files that are not images.

answered Jan 26, 2017 at 4:17

user4395445

4 Comments

Bryce Harrison Over a year ago

It shows an error whenever I upload certain photos though

user4395445 Over a year ago

Use $img = @imagecreatefromstring (@file_get_contents($path_to_img)); if the result is false, your uploaded file is not an image.if true, boom!!

user4395445 Over a year ago

sorry for mentioning getimagesize() again and, the issue you are facing because of meta tags of image. bcoz most of images consist of hidden meta tags and due to that your result is not accurate, but imagecreatefromstring will do the trick

Dennis Heiden Over a year ago

"Caution: This function expects filename to be a valid image file. If a non-image file is supplied, it may be incorrectly detected as an image and the function will return successfully, but the array may contain nonsensical values. Do not use getimagesize() to check that a given file is a valid image. Use a purpose-built solution such as the Fileinfo extension instead." - php.net/manual/en/function.getimagesize.php

user7378660 · Accepted Answer · 2017-01-26 05:13:09Z

<?php
$target_dir = "uploads/";
$target_file = $target_dir . basename($_FILES["fileToUpload"]["name"]);
$uploadOk = 1;
$imageFileType = pathinfo($target_file,PATHINFO_EXTENSION);
// Check if image file is a actual image or fake image
if(isset($_POST["submit"])) {
    $check = getimagesize($_FILES["fileToUpload"]["tmp_name"]);
    if($check !== false) {
        echo "File is an image - " . $check["mime"] . ".";
        $uploadOk = 1;
    } else {
        echo "File is not an image.";
        $uploadOk = 0;
    }
}
// Check if file already exists
if (file_exists($target_file)) {
    echo "Sorry, file already exists.";
    $uploadOk = 0;
}
// Check file size
if ($_FILES["fileToUpload"]["size"] > 500000) {
    echo "Sorry, your file is too large.";
    $uploadOk = 0;
}
// Allow certain file formats
if($imageFileType != "jpg" && $imageFileType != "png" && $imageFileType != "jpeg"
&& $imageFileType != "gif" ) {
    echo "Sorry, only JPG, JPEG, PNG & GIF files are allowed.";
    $uploadOk = 0;
}
// Check if $uploadOk is set to 0 by an error
if ($uploadOk == 0) {
    echo "Sorry, your file was not uploaded.";
// if everything is ok, try to upload file
} else {
    if (move_uploaded_file($_FILES["fileToUpload"]["tmp_name"], $target_file)) {
        echo "The file ". basename( $_FILES["fileToUpload"]["name"]). " has been uploaded.";
    } else {
        echo "Sorry, there was an error uploading your file.";
    }
}
?>

Downvoted for copy/paste of W3Schools page. That's the code most people finding this are trying to troubleshoot...

Collectives™ on Stack Overflow

PHP check if uploaded file is an image

3 Answers 3

Comments

4 Comments

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

4 Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related