How can PHP developers ensure that the MIME type check for uploaded files is reliable and secure, considering potential inconsistencies in $_FILES['datei']['type'] values?

The issue with relying on $_FILES['datei']['type'] for MIME type validation is that it can be manipulated by the user and may not always provide accurate information. To ensure a reliable and secure MIME type check, PHP developers can use fileinfo extension to determine the actual MIME type of the uploaded file. 

// Validate MIME type using fileinfo extension
$finfo = finfo_open(FILEINFO_MIME_TYPE);
$mime = finfo_file($finfo, $_FILES['datei']['tmp_name']);

// Allowed MIME types
$allowed_mime_types = array('image/jpeg', 'image/png', 'image/gif');

if (in_array($mime, $allowed_mime_types)) {
    // File is of allowed MIME type
    // Proceed with file handling
} else {
    // File is not of allowed MIME type
    // Handle the error accordingly
}

finfo_close($finfo);

Keywords

PHP MIME type file upload $_FILES validation

Related Questions