What are the potential pitfalls of using the finfo class in PHP for file validation?

One potential pitfall of using the finfo class in PHP for file validation is that it relies on file extensions, which can be easily manipulated by users. To improve security, it is recommended to use file signatures (magic numbers) to validate file types instead. 

$finfo = finfo_open(FILEINFO_MIME_TYPE);
$mime_type = finfo_file($finfo, $file_path);

if ($mime_type == 'image/jpeg' || $mime_type == 'image/png') {
    // File is a valid image file
} else {
    // File is not a valid image file
}
finfo_close($finfo);

Keywords

finfo class file validation PHP security vulnerabilities MIME type detection

Related Questions