Question

Possible Duplicate:
How to check file types of uploaded files in PHP?

Creating a text file and rename it to anything.jpg and try uploading it on facebook, facebook detects that the file is not an image and says Please select an image file or something like that. How do they do it?

I tested it out on my localhost by creating a dummy html form along with a <input type="file"... element and uploaded an image file created by renaming a text file to something.jpg and the file type in $_FILES['control_name']['type'] showed image/jpeg… How do I block users from uploading such ‘fake’ images. I think restriction using $_FILES['control_name']['type'] is not a solution, right?

Answer 1

When you process image on server, use image manipulation library (getimagesize for example) to detect it’s width and height. When this fails, reject the image. You will probably do it anyway to generate thumbnail, so it is like one extra if.