Question

I have a validation function I’m using inside of codeigniter.

function valid_image() {
    if ( ($_FILES["file"]["type"] != "image/jpeg") || ($_FILES["file"]["type"] != "image/gif")  ) {
    $this->form_validation->set_message('valid_image', 'Wrong file type..');

    return false;
} else {
    return true;
}

With just the “image/jpeg” part in the if statement it works fine. If I try to upload anything other than a jpg file it fails. If I run the code above, it fails with both a jpg or a gif file.

And before someone says “why not use the upload class,” I can’t. I’m saving my pics directly into MongoDB, so the upload class doesn’t help much.

Answer 1

This doesn’t really answer your question, but…

The $_FILE[blah]["type"] parameter is set by the web browser and as such is user data that can’t be trusted.

You may want to use exif_imagetype($_FILES["file"]["tmp_name"]) instead to detect the true image type.

function valid_image() {
    $type = exif_imagetype($_FILES["file"]["tmp_name"]);
    if (($type != IMAGETYPE_GIF) && ($type != IMAGETYPE_JPEG)) {
        $this->form_validation->set_message('valid_image', 'Wrong file type..');
        return false;
    } else {
        return true;
    }
}

Edit: If the exif extension isn’t installed, you can also do this:

$sizes = getimagesize($_FILES["file"]["tmp_name"]);

$sizes[2] will contain a value corresponding to one of the IMAGETYPE constants.

function valid_image() {
    $sizes = getimagesize($_FILES["file"]["tmp_name"]);
    if (($sizes[2] != IMAGETYPE_GIF) && ($sizes[2] != IMAGETYPE_JPEG)) {
        $this->form_validation->set_message('valid_image', 'Wrong file type..');
        return false;
    } else {
        return true;
    }
}