What are the risks of solely relying on the file extension to determine the type of videos that users upload in PHP?

Relying solely on the file extension to determine the type of videos users upload in PHP is risky because file extensions can be easily manipulated or spoofed. To mitigate this risk, it is recommended to use file validation based on the file's MIME type in addition to checking the file extension. 

// Get the MIME type of the uploaded file
$mime = mime_content_type($_FILES['video']['tmp_name']);

// Allowed MIME types for videos
$allowedMimeTypes = ['video/mp4', 'video/mpeg', 'video/quicktime'];

// Check if the uploaded file is a video based on its MIME type
if (in_array($mime, $allowedMimeTypes)) {
    // Process the uploaded video
} else {
    // Handle invalid video file
    echo "Invalid video file format. Please upload a valid video file.";
}

Keywords

file extension video type MIME type security vulnerability validation user input

Related Questions