Php image validation

Question

Thus anyone has any idea why this code is not working for me

$type1 = $_FILES['textfield2']['type'];
$type2 = $_FILES['textfield3']['type']; 

if($type1 == 'image/gif' || $type1 == 'image/png' && $type2 == 'image/gif' || $type2  == 'image/png')
{
    echo 'Valid';
    echo $type1.'<br />'.$type2;
}
else
{
    echo 'Invalid';
}

If i select 1st file as a zip or any other format and then next as png it is going to valid that what i should not

Careful, in IE some of the 'filetypes' are completely different from that of FF. I couldn't figure out why my PNG files werent being displayed correctly, it seems they were uploaded as image/x-png type. — sdot257
– sdot257, Commented Aug 31, 2011 at 16:56

Marc B · Accepted Answer · 2011-08-31 16:34:08Z

2

PHP's operator precedence makes && bind tighter than ||, so your test is coming out as:

if($type1 == 'image/gif' || ($type1 == 'image/png' && $type2 == 'image/gif') || $type2  == 'image/png')
                            ^----------------------------------------------^

Beyond that, do not use the user-provided ['type'] data for this. It's utterly trivial to forge, and someone can set to 'image/gif' while uploading nastyvirus.exe.

answered Aug 31, 2011 at 16:34

Marc B

362k44 gold badges433 silver badges508 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Henry Over a year ago

so is there any work around coz i have to validate three fields of images i can't even go through with 2 and i have 6 types of file formats to validate

Marc B Over a year ago

use getimagesize(). It'll analyze the file itself and tell you what it is.

tailor Over a year ago

hi not hare image size validation , image upload validation as image uploading confirm.

Treffynnon · Accepted Answer · 2011-08-31 16:34:04Z

1

Try:

if(($type1 == 'image/gif' || $type1 == 'image/png') && 
   ($type2 == 'image/gif' || $type2  == 'image/png'))
        {
            echo 'Valid';

            echo $type1.'<br />'.$type2;
        }
        else
        {
            echo 'Invalid';
        }

This is due to operator precedence, which is documented here: http://php.net/manual/en/language.operators.precedence.php

answered Aug 31, 2011 at 16:34

Treffynnon

21.6k6 gold badges68 silver badges99 bronze badges

1 Comment

Henry Over a year ago

Yup Niki That worked , fool of me just a simple thing and i am scratching my head from last 30min's Special thanks to you coz u replied 1st and it was ryt

NikiC · Accepted Answer · 2011-08-31 16:36:07Z

1

This is due to operator precedence. && has higher precedence than || so your expression results in:

    $type1 == 'image/gif'
|| ($type1 == 'image/png' && $type2 == 'image/gif')
||  $type2 == 'image/png'

Use parentheses to make your intention clear:

   ($type1 == 'image/gif' || $type1 == 'image/png')
&& ($type2 == 'image/gif' || $type2 == 'image/png')

Additionally please note that the mime type is a client supplied data and thus is very easy to manipulate. Instead you should check for a valid GIF/PNG file header (using the GD library for example.)

answered Aug 31, 2011 at 16:36

NikiC

102k39 gold badges194 silver badges226 bronze badges

1 Comment

Henry Over a year ago

Yup Niki That worked , fool of me just a simple thing and i am scratching my head from last 30min's

Collectives™ on Stack Overflow

Php image validation

3 Answers 3

3 Comments

1 Comment

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

3 Comments

1 Comment

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related