Why is there a mime type inconsistency with firefox, chrome?

Question

I was puzzled at first why my files weren't uploading for some users and I found out it was everyone who wasn't using chrome which was the browser I was testing.

Basically I'm doing a file check to make sure they are only able to upload mp3s.

This this was working for chrome, but not firefox.

if ($_FILES['uploaded']['type']=="audio/mp3")

This was working for firefox, but not chrome.

$_FILES['uploaded']['type']=="audio/mpeg"

Could anyone explain why this is happening? I would think both browsers would be able to understand either or... Are there any other browsers I might need to worry about touchy mime types like these?

Edit: If what Pekka suggested is true, what would be the best way to check for a certain mime type?

Answer 1

According to w3schools, audio/mpeg is the correct type. But it doesn't matter, MIME types can vary, you absolutely can't rely on them when checking files. Inconsistencies are the rule, and to be expected.

To identify a MP3 file, maybe the getid3 package can help you:

getID3() is a PHP script that extracts useful information from MP3s & other multimedia file formats.

Edit: IANA has an official list of MIME types here. There is no mention of mp3 there, so this is buggy behaviour on Chrome's part.

Edit 2: Your best bet on server side to determine the MIME type of a file is the finfo extension. It tries to determine the type of a file by "content sniffing", looking for specific characteristics of certain file types in the first few bytes of the data. In this process, MIME types can also vary, but at least they are consistent on the same server, so you won't have browser issues any more.

Answer 2

Each browser may implement the W3c standards slightly differently, much to the chagrin of all developers (#rant)...

Relying on meta information generated by a user/browser is highly unreliable and not recommended. If this is your only security/sanity mechanism then someone wishing to cause harm to your system could manually enter the meta type field with a custom request to == "audio/mpeg" then upload any kind of executable file. If you really want to be sure you must fully examine the data on the server side once it has been uploaded before accepting it into your permanent storage / production system. Or on a less sinister note.. a user with a different browser you have not tested before could want to upload a legit mp3 file but it may not announce its mime type as audio/mpeg or audio/mp3 and then you would deny them access to the system...