note 109495 modified in features.file-upload by aharvey

MIME type can be faked.

VVV

$_FILES['userfile']['type']

The mime type of the file, if the browser provided this information. An example would be "image/gif". This mime type is however not checked on the PHP side and therefore don't take its value for granted.

http://www.php.net/manual/en/features.file-upload.post-method.php

[Editor's note: removed a reference to a deleted note, and edited the note to make sense by itself.] --was-- @ Anonymous 27-Jun-2012 11:20 "In this script we add some restrictions to the file upload. The user may only upload .gif or .jpeg files" MIME type can be faked, With the example you provided you are opening yourself malicious uploads. VVV $_FILES['userfile']['type'] The mime type of the file, if the browser provided this information. An example would be "image/gif". This mime type is however not checked on the PHP side and therefore don't take its value for granted. http://www.php.net/manual/en/features.file-upload.post-method.php http://php.net/manual/en/features.file-upload.php