3

Right now I'm trying to write a script that will only accept certain audio files for upload to a server.

However, some MIME types are being returned as null.

Here is some code fragments:

PHP:

$allowedExt=array('audio/mp4a-latm');
if(isset($_POST))
{
    print_r($_FILES);
    //ToDo: Limit by File Size
    if(in_array($_FILES["fileUpload"]["type"],$allowedExt)){
    echo "file type found";
    }
    else
    echo "wrong file type";
}

HTML:

<form action="php/FileUpload.php" method="POST" enctype="multipart/form-data">
 Choose a file: <input name="fileUpload" type="file" /><br />
 <input type="submit" value="Upload" />
 </form>

The result of the above is:

Array ( [fileUpload] => Array ( [name] => 02 Helix Nebula.m4a [type] => [tmp_name] => <removed for space...>))
wrong file type

From what I understand, type should return the file's MIME type. In this case 'audio/mp4a-latm' for a .m4a file.

If php is properly returning null for .m4a files, then what would be the best approach to ensure I'm actually dealing with audio files? Is there anything more definite than just parsing for the file extensions? (ensure someone hasn't change the extension of say a text document)

1
  • I'm not sure why it doesn't return the correct file type in your case (probably missing something simple--it should), but if .m4a's mime type is defined as audio on the server (you can usually define this yourself even in a shared hosting environment), then there's not so much danger in doing a check by extension. Still, I agree it would be better to actually solve the problem.
    – Ynhockey
    Mar 11, 2012 at 9:28

3 Answers 3

3

The MIME element comes from the browser, which means it can be manipulated and thus is not trustworthy.

Either check the extension, or if you really want, parse the first few bytes of the file to make sure it's what is expected.

3
  • 1
    To expand on the topic - you can avoid reinventing the wheel and check the file using Fileinfo
    – ashein
    Mar 11, 2012 at 10:53
  • @ashein very good point. That's a very unpleasant wheel to recreate. (At question asker: In 99% of situations though, a whitelist of extensions is typically sufficient.)
    – Corbin
    Mar 11, 2012 at 20:08
  • Extensions are also pretty unreliable :)
    – Wilt
    Nov 11, 2014 at 17:00
1

$_FILES['userfile']['type'] - The mime type of the file, if the browser provided this information.

http://www.php.net/manual/en/features.file-upload.post-method.php

That's why this method doesn't work well. You should compare file extension grabbed from

$_FILES['userfile']['name']

with acceptable extensions array (which you should create by yourself)

0

If you use php 5.3 or higher you can activate the php file info extension by escaping this line in your php.ini:

extension=php_fileinfo.dll

Then you can get your mime type from the file in php like this:

$pathToFile = 'my/path/to/file.ext';
$fileInfo = finfo_open(FILEINFO_MIME_TYPE);
$mimeType = finfo_file($fileInfo, $pathToFile);
finfo_close($fileInfo);

This is more reliable than using what the browser sends you in the $_FILES array from your POST request.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.