Re: filtering uploaded files

Angelo Zanetti wrote:

hi Richard this sounds like quite a serious subject but is there no other way to check the validity of the file and type without using the unix command? IE using PHP and not depending on system commands? thanks for your insight so far, very important.

The equivalent of file command is mime_content_type() php function (if enabled). Other alternatives are to use fgetcsv() to check if the file is a csv file, imagesize() to check for image files, and similar. But you can never be 100% sure the file is completely valid without checking the whole file. For example mime_content_type() and imagesize() check only first few bytes, but the rest of the file might be junk.