That's not only an INSECURE

greg — Fri, 07 Aug 2009 12:37:00 +0000

That's not only an INSECURE approach, it's badly written, wont work and incomplete!

The mime type alone is not really a secure method to identify a file type.
You can use it, but in conjunction with other things, such as checking file extension(s) (is .jpg or is .gif etc).

Also, why not allow png? It's one of the best compression formats for the web.

You set the variable "$msg" to contain various error messages, but never actually use the var (never echoed).

You perform an "IF" test on these two variables: $userfile_size AND $userfile_type, but you haven't actually set them to be anything, they are null and therefore them checking if filesize and type is as should be will always return FALSE (i.e. they will be allowed regardless of their type and size).

Besides, you didn't set the required file size limit in the html form anyway.

________________

All in all, it's a fairly bad tutorial considering you are a web development site! Do you provide clients with this poor level of security in their code and sites?
Also, this is worded "EXACTLY" on other sites, so is this your tutorial or someone else's you have copied?

I can only advise anyone reading this to stay WELL CLEAR of using elevationnewmedia.com's web services!