What are common pitfalls when using $_FILES['probe']['type'] to determine file type in PHP?

Using $_FILES['probe']['type'] to determine file type in PHP can be unreliable as it relies on the MIME type provided by the client, which can be easily manipulated. It is recommended to use file extension validation in addition to MIME type checking for more secure file type verification. 

$allowedExtensions = array('jpg', 'jpeg', 'png', 'gif');
$uploadedFileExtension = pathinfo($_FILES['probe']['name'], PATHINFO_EXTENSION);

if (in_array($uploadedFileExtension, $allowedExtensions) && $_FILES['probe']['type'] == 'image/jpeg') {
    // File type is valid
} else {
    // File type is not allowed
}

Keywords

$_FILES file type MIME type validation security

Related Questions