php file upload, how to restrict file upload type

Question

I have the following code to check if (resume and reference letter uploaded match desired type (pdf OR doc OR docx) and size (less than 400 kb)

//check file extension and size $resume= ($_FILES['resume']['name']); $reference= ($_FILES['reference']['name']); $ext = strrchr($resume, "."); $ext1 = strrchr($reference, "."); if (!(($_FILES["resume"]["type"] == "application/doc") || ($_FILES["resume"]["type"] == "application/docx") || ($_FILES["resume"]["type"] == "application/pdf" )) && (($_FILES["reference"]["type"] == "application/doc") || ($_FILES["reference"]["type"] == "application/docx") || ($_FILES["reference"]["type"] == "application/pdf")) && (($ext == ".pdf") || ($ext == ".doc") || ($ext == ".docx")) && (($ext1 == ".pdf") || ($ext1 == ".doc") || ($ext1 == ".docx")) && ($_FILES["resume"]["size"] < 400000) //accept upto 500 kb && ($_FILES["reference"]["size"] < 400000)) { stop user } else { allow files to upload }

This is not working as desired, allows even txt files through + the size limit is not being checked, what is wrong with it?

Thanks,

OMG, you should rewrite it instead of finding the bug :-) Start by creating a list of allowed mime-types and file endings, then check against this list... — home
– home, Commented Sep 6, 2011 at 15:16

Ahmed Syed · Accepted Answer · 2016-02-23 07:10:17Z

7

The below just uses the mime types to validate a file, then checks the size of both. For a list of most mime types see here or google.

function allowed_file(){ //Add the allowed mime-type files to an 'allowed' array $allowed = array('application/doc', 'application/pdf', 'another/type'); //Check uploaded file type is in the above array (therefore valid) if(in_array($_FILES['resume']['type'], $allowed) AND in_array($_FILES['reference']['type'], $allowed)){ //If filetypes allowed types are found, continue to check filesize: if($_FILES["resume"]["size"] < 400000 AND $_FILES["reference"]["size"] < 400000 ){ //if both files are below given size limit, allow upload //Begin filemove here.... } } }

edited Feb 23, 2016 at 7:10

Ahmed Syed

1,1994 gold badges18 silver badges47 bronze badges

answered Sep 6, 2011 at 15:57

user885983

5064 silver badges10 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Michael Garrison Over a year ago

I realize this post is from last year but I ran into the same issue. I attempted the answer above but my doc and pdf test files do not pass in safari and chrome (haven't tested in ie or ff). Both files are well under the 400kb specified in the script above. I went to the link and got the correct mimes: application/msword (doc) | application/pdf (pdf) | and text/plain (txt). The only other thing I took out was the reference parts.

Michael Garrison Over a year ago

Couldn't get it to work so I modified it a bit to work for me: ` //Add the allowed mime-type files to an 'allowed' array --endline-- $allowed = array('doc', 'docx', 'txt', 'pdf'); --endline-- //Check uploaded file type is in the above array (therefore valid) --endline-- if(in_array(pathinfo($_FILES['resume']['name'], PATHINFO_EXTENSION), $allowed)){ --endline--`

vertigoelectric Over a year ago

Even though this post is very old, just in case someone like me finds it trying to get help, I have relevant information to add. The $_FILES['whatever']['type'] value includes quotations, so for example it would be "application/pdf". Those quotations will need to be removed in order for the comparison to match with in_array. For example, in_array(str_replace('"','',$_FILES['whatever']['type'], $allowed))

yvan · Accepted Answer · 2011-09-06 15:16:00Z

The Mime type for docx is application/vnd.openxmlformatsofficedocument.wordprocessingml.document

xkrv · Accepted Answer · 2011-09-06 15:38:13Z

Here is some code I wrote in the past..

function checkFileExtension($ext) { if ($ext == 'ai' || $ext == 'pdf' || $ext == 'jpg' || $ext == 'jpeg' || $ext == 'gif' || $ext == 'eps' || $ext == 'tif' || $ext == 'png' || $ext == 'xls' || $ext == 'xlsx' || $ext == 'doc' || $ext == 'docx' || $ext == 'ppt' || $ext == 'pptx' || $ext == 'zip' || $ext == 'rar' || $ext == 'sitx' || $ext == 'psd' || $ext == 'indd' || $ext == 'dng') { $pass = (int)1; } else { $pass = (int)0; } return (int)$pass; } $ext = substr(strrchr($_FILES['file']['name'], "."), 1); $fileAccepted = checkFileExtension($ext); $fileSize = $_FILES['file']['size']; if($fileAccepted==1 && $fileSize > '82428800'){ // do stuff }

Hassan Al-Jeshi · Accepted Answer · 2011-09-06 15:40:37Z

To do that I usually using something like that:

$filename = $_FILES['field_name']['name']; // Get the name of the file (including file extension). $ext = strtolower(substr($filename, strpos($filename,'.'), strlen($filename)-1)); //get the extention in lower case

And than check if the file extension is accepted.

Also be aware that that the user can simply change the extension for a dangerous file, so it is safer to check with the mime type

user898741 · Accepted Answer · 2011-09-06 15:43:57Z

This may be useful:

First check desired mime types to verify:

Microsoft Office MIME Types and List of MIME Types

Then try make your code easier...

 $mimeTypes = array('application/vnd.openxmlformats-officedocument.wordprocessingml.document', 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet', 'application/vnd.openxmlformats-officedocument.presentationml.presentation'); if (in_array($_FILES["resume"]["type"], $mimeTypes)) { // File's OK } else { // Bad file ! }

Important: User may change file extension, so always check the mime type intead of extension!! =)

Collectives™ on Stack Overflow

php file upload, how to restrict file upload type

5 Answers 5

3 Comments

Comments

Comments

Comments

Comments

Linked

Hot Network Questions

Collectives™ on Stack Overflow

5 Answers 5

3 Comments

Comments

Comments

Comments

Comments

Linked

Related