What are the limitations of using the "accept" parameter for file type validation in PHP?

When using the "accept" parameter for file type validation in PHP, it only checks the file extension, which can be easily manipulated by the user. To enhance security, it is recommended to perform server-side validation by checking the file's MIME type. This ensures that the file type is validated based on its actual content rather than just the extension. 

// Server-side validation using MIME type
$allowedMimeTypes = ['image/jpeg', 'image/png', 'image/gif'];
$fileMimeType = mime_content_type($_FILES['file']['tmp_name']);

if (in_array($fileMimeType, $allowedMimeTypes)) {
    // File type is valid
    // Proceed with file upload
} else {
    // Invalid file type
    echo "Invalid file type. Please upload a JPEG, PNG, or GIF file.";
}

Keywords

file type validation accept parameter limitations PHP error types

Related Questions