Entry

How can I get the mime type of an uploaded file?

How does PHP work out the mime type of an uploaded file?

May 14th, 2000 18:09
Nathan Wallace, Brent Sims, Richard Lynch, Dieter Kneffel

Assuming a post method upload, accomplishing this is very very tricky... 

        $userfile - the temp file name
        $userfile_name - gives you the original name
        $userfule_size - gives you the file size in bytes
        $userfile_type - give you, you guessed it, the mime type.

The hardest part of figuring out how to do all of this was believing it
is just this simple. Upload the file, give it a name and then tack _name
or _size or _type onto that name and, well, that's the size of it...

But, just how careful is the PHP code in determining $userfile_type?

Does it rely on what the browser sent (does the browser say?), or merely
the extension, or does it look at the actual file's contents?

The docs say:

* $userfile_type - The mime type of the file if the browser provided
this information. An example would be "image/gif".

This would lead me to believe that relying on $userfile_type would not
be the most secure idea, since it would not be rocket science for a
malicious user to convince their own computer to lie to your server.

It is not safe at all; We've had some problems with this in the past. As
expectible, most problems occured when using MSIE on MacOS. In our
cases, we were running in the problem that IE did not give any
information about the type, resulting in an empty '$userfile_type'    
On the other side, Netscape made no problems at all.