What potential pitfalls should PHP developers be aware of when verifying file types for video uploads?

One potential pitfall for PHP developers when verifying file types for video uploads is relying solely on the file extension. Attackers can easily manipulate file extensions to bypass this check. To mitigate this risk, developers should also validate the file's MIME type to ensure it matches the expected video format. 

// Get the MIME type of the uploaded file
$uploadedFileType = $_FILES['video']['type'];

// Define an array of allowed video MIME types
$allowedMimeTypes = array('video/mp4', 'video/mpeg', 'video/quicktime');

// Check if the uploaded file's MIME type is in the allowed list
if (in_array($uploadedFileType, $allowedMimeTypes)) {
    // File type is valid, proceed with upload
} else {
    // Invalid file type, reject the upload
    echo 'Invalid file type. Please upload a valid video file.';
}

Keywords

file type validation video uploads MIME types security vulnerabilities PHP functions

Related Questions