How to check file is valid image or not using php?
i need your suggestions for checking image file. If a user will upload any file with changed extension type like (jpg,jpeg,bmp,png) how do we figure out that in PHP?
I don't want to check only file type extentions but i want to know that the uploaded file is not a malicious file by changing it's extention type.
Like: we have hack.php file and we change it with hack.jpg file so how to we identify that this is not a valid file.
php file file-type
asked Nov 21 '18 at 8:08
Vishnu SharmaVishnu Sharma
97
|
show 4 more comments
i need your suggestions for checking image file. If a user will upload any file with changed extension type like (jpg,jpeg,bmp,png) how do we figure out that in PHP?
I don't want to check only file type extentions but i want to know that the uploaded file is not a malicious file by changing it's extention type.
Like: we have hack.php file and we change it with hack.jpg file so how to we identify that this is not a valid file.
php file file-type
asked Nov 21 '18 at 8:08
Vishnu SharmaVishnu Sharma
97
Why should that be of interest? If a user uploads something, then that is his own problem. Typically you only want to re-deliver that if it is requested. If someone uploaded a text file renamed somehow, then fine, he get's back a text file.
– arkascha
Nov 21 '18 at 8:11
Have you done anything on your own yet? You are expected to try to write the code yourself. Please read How to create a Minimal, Complete, and Verifiable example.
– kerbholz
Nov 21 '18 at 8:21
@arkascha that could open your application to security issues.
– Federico klez Culloca
Nov 21 '18 at 8:26
2
@FedericoklezCulloca Can you explain how that is possible?
– patrick
Nov 21 '18 at 8:50
2
@FedericoklezCulloca That requires server code that executes user provided data. A bad idea in the first place.
– patrick
Nov 21 '18 at 9:33
|
show 4 more comments
i need your suggestions for checking image file. If a user will upload any file with changed extension type like (jpg,jpeg,bmp,png) how do we figure out that in PHP?
I don't want to check only file type extentions but i want to know that the uploaded file is not a malicious file by changing it's extention type.
Like: we have hack.php file and we change it with hack.jpg file so how to we identify that this is not a valid file.
php file file-type
asked Nov 21 '18 at 8:08
Vishnu SharmaVishnu Sharma
97
i need your suggestions for checking image file. If a user will upload any file with changed extension type like (jpg,jpeg,bmp,png) how do we figure out that in PHP?
I don't want to check only file type extentions but i want to know that the uploaded file is not a malicious file by changing it's extention type.
Like: we have hack.php file and we change it with hack.jpg file so how to we identify that this is not a valid file.
php file file-type
php file file-type
asked Nov 21 '18 at 8:08
Vishnu SharmaVishnu Sharma
97
asked Nov 21 '18 at 8:08
Vishnu SharmaVishnu Sharma
97
edited Nov 22 '18 at 11:52
Vishnu Sharma
asked Nov 21 '18 at 8:08
Vishnu SharmaVishnu Sharma
97
asked Nov 21 '18 at 8:08
Vishnu SharmaVishnu Sharma
97
asked Nov 21 '18 at 8:08
Vishnu SharmaVishnu Sharma
97
97
Why should that be of interest? If a user uploads something, then that is his own problem. Typically you only want to re-deliver that if it is requested. If someone uploaded a text file renamed somehow, then fine, he get's back a text file.
– arkascha
Nov 21 '18 at 8:11
Have you done anything on your own yet? You are expected to try to write the code yourself. Please read How to create a Minimal, Complete, and Verifiable example.
– kerbholz
Nov 21 '18 at 8:21
@arkascha that could open your application to security issues.
– Federico klez Culloca
Nov 21 '18 at 8:26
2
@FedericoklezCulloca Can you explain how that is possible?
– patrick
Nov 21 '18 at 8:50
2
@FedericoklezCulloca That requires server code that executes user provided data. A bad idea in the first place.
– patrick
Nov 21 '18 at 9:33
|
show 4 more comments
Why should that be of interest? If a user uploads something, then that is his own problem. Typically you only want to re-deliver that if it is requested. If someone uploaded a text file renamed somehow, then fine, he get's back a text file.
– arkascha
Nov 21 '18 at 8:11
Have you done anything on your own yet? You are expected to try to write the code yourself. Please read How to create a Minimal, Complete, and Verifiable example.
– kerbholz
Nov 21 '18 at 8:21
@arkascha that could open your application to security issues.
– Federico klez Culloca
Nov 21 '18 at 8:26
2
@FedericoklezCulloca Can you explain how that is possible?
– patrick
Nov 21 '18 at 8:50
2
@FedericoklezCulloca That requires server code that executes user provided data. A bad idea in the first place.
– patrick
Nov 21 '18 at 9:33
Why should that be of interest? If a user uploads something, then that is his own problem. Typically you only want to re-deliver that if it is requested. If someone uploaded a text file renamed somehow, then fine, he get's back a text file.
– arkascha
Nov 21 '18 at 8:11
Why should that be of interest? If a user uploads something, then that is his own problem. Typically you only want to re-deliver that if it is requested. If someone uploaded a text file renamed somehow, then fine, he get's back a text file.
– arkascha
Nov 21 '18 at 8:11
Have you done anything on your own yet? You are expected to try to write the code yourself. Please read How to create a Minimal, Complete, and Verifiable example.
– kerbholz
Nov 21 '18 at 8:21
Have you done anything on your own yet? You are expected to try to write the code yourself. Please read How to create a Minimal, Complete, and Verifiable example.
– kerbholz
Nov 21 '18 at 8:21
@arkascha that could open your application to security issues.
– Federico klez Culloca
Nov 21 '18 at 8:26
@arkascha that could open your application to security issues.
– Federico klez Culloca
Nov 21 '18 at 8:26
2
2
@FedericoklezCulloca Can you explain how that is possible?
– patrick
Nov 21 '18 at 8:50
@FedericoklezCulloca Can you explain how that is possible?
– patrick
Nov 21 '18 at 8:50
2
2
@FedericoklezCulloca That requires server code that executes user provided data. A bad idea in the first place.
– patrick
Nov 21 '18 at 9:33
@FedericoklezCulloca That requires server code that executes user provided data. A bad idea in the first place.
– patrick
Nov 21 '18 at 9:33
|
show 4 more comments
1 Answer
1
active
oldest
votes
I will use mime_content_type if exists. Else execute linux command of file -i -b on the file to get the answer.
Consider function as following:
function getFileType($file_name) {
if(! function_exists('mime_content_type')) {
$isUnix = strtoupper(substr(PHP_OS, 0, 3)) !== 'WIN' && DIRECTORY_SEPARATOR === '/';
// check whether operating system is that of a UNIX type.
if ($isUnix) {
$type = null;
exec('file -i -b ' . realpath($file_name), $type);
$parts = @ explode(";", $type[0]); // can be of format text/plain; charset=us-ascii
return trim($parts[0]);
}
// the file program/command does not exist on Windows.
else {
return null;
}
} else {
return mime_content_type($file_name);
}
}
You can also use finfo-file is you prefer.
answered Nov 21 '18 at 8:22
David WinderDavid Winder
3,6483727
Or you can spare yourself the shellout and usefinfo_file
– Federico klez Culloca
Nov 21 '18 at 8:25
add a comment |
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53407649%2fhow-to-check-file-is-valid-image-or-not-using-php%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
I will use mime_content_type if exists. Else execute linux command of file -i -b on the file to get the answer.
Consider function as following:
function getFileType($file_name) {
if(! function_exists('mime_content_type')) {
$isUnix = strtoupper(substr(PHP_OS, 0, 3)) !== 'WIN' && DIRECTORY_SEPARATOR === '/';
// check whether operating system is that of a UNIX type.
if ($isUnix) {
$type = null;
exec('file -i -b ' . realpath($file_name), $type);
$parts = @ explode(";", $type[0]); // can be of format text/plain; charset=us-ascii
return trim($parts[0]);
}
// the file program/command does not exist on Windows.
else {
return null;
}
} else {
return mime_content_type($file_name);
}
}
You can also use finfo-file is you prefer.
answered Nov 21 '18 at 8:22
David WinderDavid Winder
3,6483727
Or you can spare yourself the shellout and usefinfo_file
– Federico klez Culloca
Nov 21 '18 at 8:25
add a comment |
I will use mime_content_type if exists. Else execute linux command of file -i -b on the file to get the answer.
Consider function as following:
function getFileType($file_name) {
if(! function_exists('mime_content_type')) {
$isUnix = strtoupper(substr(PHP_OS, 0, 3)) !== 'WIN' && DIRECTORY_SEPARATOR === '/';
// check whether operating system is that of a UNIX type.
if ($isUnix) {
$type = null;
exec('file -i -b ' . realpath($file_name), $type);
$parts = @ explode(";", $type[0]); // can be of format text/plain; charset=us-ascii
return trim($parts[0]);
}
// the file program/command does not exist on Windows.
else {
return null;
}
} else {
return mime_content_type($file_name);
}
}
You can also use finfo-file is you prefer.
answered Nov 21 '18 at 8:22
David WinderDavid Winder
3,6483727
Or you can spare yourself the shellout and usefinfo_file
– Federico klez Culloca
Nov 21 '18 at 8:25
add a comment |
I will use mime_content_type if exists. Else execute linux command of file -i -b on the file to get the answer.
Consider function as following:
function getFileType($file_name) {
if(! function_exists('mime_content_type')) {
$isUnix = strtoupper(substr(PHP_OS, 0, 3)) !== 'WIN' && DIRECTORY_SEPARATOR === '/';
// check whether operating system is that of a UNIX type.
if ($isUnix) {
$type = null;
exec('file -i -b ' . realpath($file_name), $type);
$parts = @ explode(";", $type[0]); // can be of format text/plain; charset=us-ascii
return trim($parts[0]);
}
// the file program/command does not exist on Windows.
else {
return null;
}
} else {
return mime_content_type($file_name);
}
}
You can also use finfo-file is you prefer.
answered Nov 21 '18 at 8:22
David WinderDavid Winder
3,6483727
I will use mime_content_type if exists. Else execute linux command of file -i -b on the file to get the answer.
Consider function as following:
function getFileType($file_name) {
if(! function_exists('mime_content_type')) {
$isUnix = strtoupper(substr(PHP_OS, 0, 3)) !== 'WIN' && DIRECTORY_SEPARATOR === '/';
// check whether operating system is that of a UNIX type.
if ($isUnix) {
$type = null;
exec('file -i -b ' . realpath($file_name), $type);
$parts = @ explode(";", $type[0]); // can be of format text/plain; charset=us-ascii
return trim($parts[0]);
}
// the file program/command does not exist on Windows.
else {
return null;
}
} else {
return mime_content_type($file_name);
}
}
You can also use finfo-file is you prefer.
answered Nov 21 '18 at 8:22
David WinderDavid Winder
3,6483727
edited Nov 21 '18 at 15:51
answered Nov 21 '18 at 8:22
David WinderDavid Winder
3,6483727
answered Nov 21 '18 at 8:22
David WinderDavid Winder
3,6483727
answered Nov 21 '18 at 8:22
David WinderDavid Winder
3,6483727
3,6483727
Or you can spare yourself the shellout and usefinfo_file
– Federico klez Culloca
Nov 21 '18 at 8:25
add a comment |
Or you can spare yourself the shellout and usefinfo_file
– Federico klez Culloca
Nov 21 '18 at 8:25
Or you can spare yourself the shellout and use
finfo_file– Federico klez Culloca
Nov 21 '18 at 8:25
Or you can spare yourself the shellout and use
finfo_file– Federico klez Culloca
Nov 21 '18 at 8:25
add a comment |
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Some of your past answers have not been well-received, and you're in danger of being blocked from answering.
Please pay close attention to the following guidance:
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53407649%2fhow-to-check-file-is-valid-image-or-not-using-php%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Why should that be of interest? If a user uploads something, then that is his own problem. Typically you only want to re-deliver that if it is requested. If someone uploaded a text file renamed somehow, then fine, he get's back a text file.
– arkascha
Nov 21 '18 at 8:11
Have you done anything on your own yet? You are expected to try to write the code yourself. Please read How to create a Minimal, Complete, and Verifiable example.
– kerbholz
Nov 21 '18 at 8:21
@arkascha that could open your application to security issues.
– Federico klez Culloca
Nov 21 '18 at 8:26
2
@FedericoklezCulloca Can you explain how that is possible?
– patrick
Nov 21 '18 at 8:50
2
@FedericoklezCulloca That requires server code that executes user provided data. A bad idea in the first place.
– patrick
Nov 21 '18 at 9:33