How to ensure that uploaded file is video or picture?

Question

Hello,

I want to be sure that user uploaded files are real videos or pictures, but not just a piece of text renamed to textfile.jpg. What are the ways to ensure?

I see the only way: detect type of file by it's extension and then, depending on file type, try to get information about it (by Imagemagick or ffmpeg).

Is there any other ways?

Thank you.

Answer 1

You could use the file command, which would tell you the file type, provided you are on a host that allows you to use functions like PHP's system.

Answer 2

On many UNIX-like systems, you have the file program that inspects the file contents. On my Ubuntu system, this accepts the --mime-type flag (Googling for file is a nightmare, so I won't try to look up how standardized this is):

$ file --mime-type some_image.jpg
some_image.jpg: image/jpeg

You can easily parse the output to see if the MIME type starts with image/ or video/.

Answer 3

If mdm's answer doesn't apply in your case, then you could check out www.wotsit.org - it provides details on a huge array of file formats...

Martin.

Answer 4

What you are looking for is the ability to identify files by the file signature (also called "magic numbers").

The file command provides this, however, you can also implement this yourself, using publicly available lists of magic numbers:

FILE SIGNATURES TABLE

Answer 5

PHP has the Fileinfo extension built-in as of 5.3, and available via PECL for earlier versions. It will tell you the MIME type of the file, among other things: http://php.net/manual/en/book.fileinfo.php