What potential pitfalls should be considered when determining the file type after upload in PHP?

One potential pitfall when determining the file type after upload in PHP is that the file extension can be easily manipulated by the user, leading to security vulnerabilities if not properly validated. To mitigate this risk, it's important to validate the file type based on its actual content rather than just relying on the file extension. 

// Get the MIME type of the uploaded file
$mime = mime_content_type($_FILES['file']['tmp_name']);

// Allowed MIME types
$allowed_types = ['image/jpeg', 'image/png', 'image/gif'];

// Check if the uploaded file is of an allowed type
if (in_array($mime, $allowed_types)) {
    echo "File type is allowed.";
} else {
    echo "File type is not allowed.";
}

Keywords

file type upload PHP MIME type validation

Related Questions