note 75932 added to features.file-upload

Beware the mime-types! Given the GIF security issue that has been doing the rounds recently you may be inclined to validate an update based on its reported mime-type from the $_FILES array. However be careful with this - it is set by the *browser*, not by PHP or the web server, and browsers are not consistent (what's new?!) For example IE6/7 will upload a progressive JPEG as image/pjpeg, while Firefox and Opera will upload it as image/jpeg. More importantly IE will try and determine the mime type of the file by actually inspecting its contents. For example if you rename a perfectly valid PNG file to end with .zip instead, IE will still send a mime type of image/x-png, where-as Firefox and Opera will send application/x-zip-compressed and application/zip respectively, even though the file is a valid PNG. In short if you are going to validate an upload on the mime-type, be sure to do some careful research and testing first! ---- Server IP: 194.145.210.3 Probable Submitter: 88.96.15.166 ---- Manual Page -- http://www.php.net/manual/en/features.file-upload.php Edit -- https://master.php.net/note/edit/75932 Del: integrated -- https://master.php.net/note/delete/75932/integrated Del: useless -- https://master.php.net/note/delete/75932/useless Del: bad code -- https://master.php.net/note/delete/75932/bad+code Del: spam -- https://master.php.net/note/delete/75932/spam Del: non-english -- https://master.php.net/note/delete/75932/non-english Del: in docs -- https://master.php.net/note/delete/75932/in+docs Del: other reasons-- https://master.php.net/note/delete/75932 Reject -- https://master.php.net/note/reject/75932 Search -- https://master.php.net/manage/user-notes.php