Question

So I have an upload script, and I want to check the file type that is being uploaded. I only want pdf, doc, docx and text files

So I have:

$goodExtensions = array('.doc','.docx','.txt','.pdf', '.PDF');
$name = $_FILES['uploadFile']['name'];
$extension = substr($name, strpos($name,'.'), strlen($name)-1);


 if(!in_array($extension,$goodExtensions) || (($_FILES['uploadFile']['type'] != "applicatioin/msword") || ($_FILES['uploadFile']['type'] != "application/pdf"))){
     $error['uploadFile'] = "File not allowed. Only .doc, .docx, .txt and pdf";
 }

Why I’m getting the error when testing and including correct documents?

Answer 1

Since you are using OR instead of AND in your expression:

 if (!in_array($extension,$goodExtensions)
     || (($_FILES['uploadFile']['type'] != "applicatioin/msword")
         || ($_FILES['uploadFile']['type'] != "application/pdf"))) {
     $error['uploadFile'] = "File not allowed. Only .doc, .docx, .txt and pdf";
 }

this always evaluates to true: if the file extension is listed in the array goodExtensions, the first expression is false. However, since the file type can not be both Word and PDF at the same time, the second bracketed expression is always true.

So if you want to ensure that either the file extension or the MIME type is good, the correct expression would be (including the fix for the typo in “applicatioin/msword”):

 if (!in_array($extension,$goodExtensions)
     || (($_FILES['uploadFile']['type'] != "application/msword")
         && ($_FILES['uploadFile']['type'] != "application/pdf"))) {
     $error['uploadFile'] = "File not allowed. Only .doc, .docx, .txt and pdf";
 }