18

Im trying to determine the mime-type of an uploaded file, i want to use fileinfo(), this is what ive been trying, it isnt working:

$uploadedfile = $_FILES['soup']['tmp_name'];
if(isset($uploadedfile))
{
    $uploadedname = $_FILES['soup']['name'];
    $file=$uploadedsong;
    $file.=$uploadedname;
    $finfo = finfo_open(FILEINFO_MIME_TYPE); 
    $mime = finfo_file($finfo, $file);

Unfortunately the finfo_file doesnt seem to be running, Im assuming i have the following $file set incorrectly for this, is there a way i can do this properly with a newly uploaded file using $_FILE like this? or am i going at this problem the completely improper way. Using a file i have pre-set in another directly, and setting $file="folder/file.doc" works properly.

3 Answers 3

34

You should be passing the path to the finfo_file function not the filename.

<?php 
if (isset($_FILES['soup']['tmp_name'])) {
    $finfo = finfo_open(FILEINFO_MIME_TYPE);
    $mime = finfo_file($finfo, $_FILES['soup']['tmp_name']);
    if ($mime == 'application/msword') {
        //Its a doc format do something
    }
    finfo_close($finfo);
}
?>
3
  • In your php.ini file, make sure you have this entry: extension=fileinfo.so or in windows: php_fileinfo.dll Mar 13, 2015 at 8:04
  • 1
    Notice: it wont work correctly if the document is of type xlsx, docx, pptx e.t.c as it would return inode/x-empty and pdf would return text/html rather than application/pdf Feb 25, 2019 at 14:33
  • I have been looking for FILEINFO_MIME_TYPE example Thank you I found this. Nov 2, 2022 at 12:05
1

I use the finfo() buffer() function as well as file_get_contents() from the php platform as below

$finfo = new finfo(FILEINFO_MIME);
$mimetype = $finfo->buffer(file_get_contents($filename)); #gives you mime type

you need to be on php 5.3 or higher and make sure you have the finfo() extension installed. for linux extension=fileinfo. and in windows: php_fileinfo.dll

you can have an array of accepted mime types and then check if it exists in that array

$acceptedMime = [];
if(in_array($mimetype, $acceptedMime, true) === true){
  #mime type is valid. Proceed!
}

Another alternative to avoid having to check mime types would be to store file uploads completely out of the document root folder.

-1

I know this is a bit old, but since you're using the $_FILES super global, can you use the type key of the file array (i.e. $_FILES['soup']['type']) rather than having the server check once the file is uploaded?

2
  • 5
    Using the $_FILES array parameters to verify file type is spoof-able. That is why the finfo_file was created so we can actually check the binary of the file to determine if it is really for example an image file and not a php file with its file extension renamed to jpg, in which case the $_FILES array type would give jpg.
    – jessiPP
    Oct 13, 2015 at 5:11
  • It's still quite easy to spoof the first bytes of a php files to trick finfo_file into thinking it's jpg. Jan 10, 2019 at 12:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.