Good content takes time and effort to come up with.
Please consider supporting us by just disabling your AD BLOCKER and reloading this page again.
In this article, I will show you a cool tip on how to properly validate the file MIME types even if they change the extension of the file.
I will cover the following in this article
finfo
)Basic knowledge on PHP. Even if you don't know how to upload the files and handle it then I have written an article on it:
This is very basic HTML form make sure you have enctype="multipart/form-data"
<form action="store_product.php" method="post" enctype="multipart/form-data">
<div>
<input type="file" name="product_invoice" id="product_invoice">
</div> <br>
<div>
<input type="submit" value="Create Product">
</div>
</form>
From the above form when you select the image and upload it will go to store_product.php
PHP file which will handle the file upload with validation.
Following is the snippet code which demonstrates the file validation
/** Store the file details in variable */
$product_invoice = $_FILES['product_invoice'];
/** Uploaded file name */
$file_name = $product_invoice['name'];
$file_tmp = $product_invoice['tmp_name'];
/** Using pathinfo() to get the file extension of file */
$pathinfo = pathinfo($file_name);
$extension = $pathinfo['extension'];
/** Allowed extensions */
$file_extensions = ['pdf', 'xls', 'jpeg', 'jpg', 'png', 'svg', 'webp'];
/** Check File extensions */
if(!in_array($extensio
n, $file_extensions)){
$errors[] = 'File allowed extensions '. implode(', ', $file_extensions);
}
The above is wrong because we are validating based on file extension. Because someone may upload video & change just the extension to jpeg or pdf.
finfo
)To properly validate the file MIME you need to use finfo
which internally uses finfo_open
Basically you use it the following way
/** Using finfo to just get the MIME type */
$finfo = new finfo(FILEINFO_MIME_TYPE);
/** You will get extension along with the mime types */
$extension = $finfo->file($file_tmp);
Full detailed on the same as follows
/** Store the file details in variable */
$product_invoice = $_FILES['product_invoice'];
/** Uploaded file name */
$file_name = $product_invoice['name'];
$file_tmp = $product_invoice['tmp_name'];
/** Allowed MIME extensions */
$file_extensions = ['image/jpeg', 'image/pjpeg', 'application/pdf'];
/** Using finfo to just get the MIME type */
$finfo = new finfo(FILEINFO_MIME_TYPE);
/** You will get extension along with the mime types */
$extension = $finfo->file($file_tmp);
/** Check File extensions */
if(!in_array($extension, $file_extensions)){
$errors[] = 'File allowed extensions '. implode(', ', $file_extensions);
}
I don't want to reinvent the wheel. So here is the link for the CODEIGNITER FRAMEWORK MIME TYPES
Hope you liked the article. If yes then please do share with your friends.
Cache Static Files With NGINX Server
Plain PHP Resumable Large File Uploads In Chunks Using FlowJs
Firebase Cloud Messaging (FCM) Browser Web Push Notifications Using Javascript And PHP
Install RabbitMQ with Docker & Running with NodeJS
Why You Should Run Cronjobs In Laravel?
Google reCAPTCHA Integration In PHP Laravel Forms
Send Email In PHP With PHPMailer
Laravel Last Executed Query In Plain SQL Statement For Debugging
Simple Way To Create Resourceful API Controller In Laravel
Move Uploaded Files From Local Computer Or Server To Amazon S3 Bucket In PHP
Free SSL Certificate In cPanel With ZeroSSL & Certbot
Stripe Payment Integration With Laravel
What Is Composer? How Does It Work? Useful Composer Commands And Usage