best way to determine if a URL is an image in PHP

Question

Using PHP, given a URL, how can I determine whether it is an image?

There is no context for the URL - it is just in the middle of a plain text file, or maybe just a string on its own.

I don't want high overhead (e.g. reading the content of the URL) as this could be called for many URLs on a page. Given this restriction, it isn't essential that all images are identified, but I would like a fairly good guess.

At the moment I am just looking at the file extension, but it feels like there should be a better way than this.

Here is what I currently have:

  function isImage( $url )
  {
    $pos = strrpos( $url, ".");
 if ($pos === false)
   return false;
 $ext = strtolower(trim(substr( $url, $pos)));
 $imgExts = array(".gif", ".jpg", ".jpeg", ".png", ".tiff", ".tif"); // this is far from complete but that's always going to be the case...
 if ( in_array($ext, $imgExts) )
   return true;
    return false;
  }

Edit: In case it's useful to anybody else here is the final function using the technique from Emil H's answer:

  function isImage($url)
  {
     $params = array('http' => array(
                  'method' => 'HEAD'
               ));
     $ctx = stream_context_create($params);
     $fp = @fopen($url, 'rb', false, $ctx);
     if (!$fp) 
        return false;  // Problem with url

    $meta = stream_get_meta_data($fp);
    if ($meta === false)
    {
        fclose($fp);
        return false;  // Problem reading data from url
    }

    $wrapper_data = $meta["wrapper_data"];
    if(is_array($wrapper_data)){
      foreach(array_keys($wrapper_data) as $hh){
          if (substr($wrapper_data[$hh], 0, 19) == "Content-Type: image") // strlen("Content-Type: image") == 19 
          {
            fclose($fp);
            return true;
          }
      }
    }

    fclose($fp);
    return false;
  }

Answer 1

You could use an HTTP HEAD request and check the content-type. This might be a good compromise. It can be done using PHP Streams. Wez Furlong has an article that shows how to use this approach to send post requests, but it can be easily adapted to send HEAD requests instead. You can retrieve the headers from an http response using stream_get_meta_data().

Of course this isn't really 100%. Some servers send incorrect headers. It will however handle cases where images are delivered through a script and the correct file extension isn't available. The only way to be really certain is to actually retrieve the image - either all of it, or the first few bytes, as suggested by thomasrutter.

Answer 2

There are a few different approaches.

• Sniff the content by looking for a magic number at the start of the file. For example, GIF uses GIF87 or GIF89 as the first five bytes of the file (in ascii). Unfortunately this can't tell you if there's an error in the image or if the image contains malicious content. Here are some magic numbers for various types of image files (feel free to use these):

  "\xff\xd8\xff" => 'image/jpeg',
  "\x89PNG\x0d\x0a\x1a\x0a" => 'image/png',
  "II*\x00" => 'image/tiff',
  "MM\x00*" => 'image/tiff',
  "\x00\x00\x01\x00" => 'image/ico',
  "\x00\x00\x02\x00" => 'image/ico',
  "GIF89a" => 'image/gif',
  "GIF87a" => 'image/gif',
  "BM" => 'image/bmp',
  

  Sniffing the content like this is probably going to fit your requirements best; you'll only have to read and therefore download the first few bytes of the file (past the header).

• Load the image using the GD library to see if it loads without error. This can tell you if the image is valid, without error or not. Unfortunately this probably doesn't fit your requirements because it requires downloading the complete image.

• If you really don't want to make an HTTP request for the image at all, then this rules out both sniffing and getting HTTP headers. You can, however, try to determine whether something is an image by the context in which it is linked. Something linked using a src attribute in an <img element is almost certainly an image (or an attempt at XSS, but that's another story). This will tell you if something is intended as an image. It won't tell you whether the image is actually available, or valid; you'll have to fetch at least the first small part (header or magic number) of the image URL to find that.

Unfortunately, it is possible for a file to be both a valid image as well as a ZIP file containing harmful content which could be executed as Java by a harmful site - see the GIFAR exploit. You can almost certainly prevent this vulnerability by loading the image in a library like GD and performing some non-trivial filter on it, like softening or sharpening it a tiny amount (ie using a convolution filter) and saving it to a fresh file without transferring any metadata across.

Trying to determine if something is an image by its content-type alone is quite unreliable, almost as unreliable as checking the file extension. When loading an image using an <img element, browsers sniff for a magic string.

Answer 3

Hi,

Suppose if the image url doesn't has extention then how to check with php that the image is i.e. jpg or gif or any other type?

For example the link is below: http://image.shopzilla.com/resize?sq=60&amp;uid=718400671

Thanks