Question

Right now I’m trying to write a script that will only accept certain audio files for upload to a server.

However, some MIME types are being returned as null.

Here is some code fragments:

PHP:

$allowedExt=array('audio/mp4a-latm');
if(isset($_POST))
{
    print_r($_FILES);
    //ToDo: Limit by File Size
    if(in_array($_FILES["fileUpload"]["type"],$allowedExt)){
    echo "file type found";
    }
    else
    echo "wrong file type";
}

HTML:

<form action="php/FileUpload.php" method="POST" enctype="multipart/form-data">
 Choose a file: <input name="fileUpload" type="file" /><br />
 <input type="submit" value="Upload" />
 </form>

The result of the above is:

Array ( [fileUpload] => Array ( [name] => 02 Helix Nebula.m4a [type] => [tmp_name] => <removed for space...>))
wrong file type

From what I understand, type should return the file’s MIME type. In this case ‘audio/mp4a-latm’ for a .m4a file.

If php is properly returning null for .m4a files, then what would be the best approach to ensure I’m actually dealing with audio files? Is there anything more definite than just parsing for the file extensions? (ensure someone hasn’t change the extension of say a text document)

Answer 1

The MIME element comes from the browser, which means it can be manipulated and thus is not trustworthy.

Either check the extension, or if you really want, parse the first few bytes of the file to make sure it’s what is expected.