Bug #78023 [Opn->Nab]: PHP File MIME content Type

Edit report at https://bugs.php.net/bug.php?id=78023&edit=1 ID: 78023 Updated by: requinix@php.net Reported by: mertwal2 at gmail dot com Summary: PHP File MIME content Type -Status: Open +Status: Not a bug Type: Bug Package: Unknown/Other Function Operating System: windows PHP Version: 7.1.29 Block user comment: N Private report: N New Comment: Best I can tell you're saying that the first one reports to be a PHP file while the second reports to be an image (or maybe zip)? That's correct. MIME type checking works by looking at the first few bytes of a file to make a *best guess* as to the contents. It is not perfect, and it won't work well for things like PHP files that can embed their code at any point in the content. You must do additional checking and/or sanitization yourself. Previous Comments: ------------------------------------------------------------------------ [2019-05-17 07:50:27] mertwal2 at gmail dot com Description: ------------ --- From manual page: https://php.net/function.mime-content-type --- I am trying to upload files which has php code inserted in files. according to mime type checking through the mime type for php files but still its through the mime type for image here is the example of image in base64 value <?php echo "hello world"?> PK here is the starting of image base64 value the code was blocked this image but not this type of content image. PK <?php echo "hello world"?> i have upload the image that contains the particular code Test script: --------------- <?php $_FILES['file']['name']; $var = mime_content_type($_FILES); echo $var; ?> Expected result: ---------------- error result on invalid mime types Actual result: -------------- success result on invalid mime type ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=78023&edit=1