Yeah, in fact this is all a

mscreashuns — Sat, 28 Jun 2008 04:46:23 +0000

Yeah, in fact this is all a bit of overkill since I'm not actually going to be putting the upload script to work publicly. I was just trying to write my own script and trying to figure out all of the security issues I could find. This one probably isn't too big of a problem either considering that even for an image upload script or something similar, a low file size restriction could be used.

I wouldn't trust the mime

pr0gr4mm3r — Sat, 28 Jun 2008 03:35:58 +0000

I wouldn't trust the mime type, but then again, it's probably not anything to be concerned about. Just make sure that the directory you upload it to isn't executable.

If you want to verify it's a certain media type, you can try to edit it accordingly. For example, load images into a PHP image object. If it fails, it's not a valid image. You can also try to re-render video & audio using something like ffmpeg. If it fails to render based on the mime type, then it isn't valid. This is probably overkill though.

I was really just wondering

mscreashuns — Sat, 28 Jun 2008 02:50:04 +0000

I was really just wondering for a general file upload script, meaning images, audio, video, etc. I'm wondering if there is a way for any type of file to tell what the true MIME type is, because according to this website you can create a program to fake a MIME type.

Glad to see my work used for something positive...lol.

Are you making an image

teammatt3 — Sat, 28 Jun 2008 01:38:00 +0000

Are you making an image upload form? I started a thread about that a few weeks ago.

Here's the PHP class I ended up creating, you might find it useful: Link to File

Hey, I just remembered, you helped me the aspect ratio logic. See, I had a good use for it