Protect file uploads via PHP

Check server-side MIME type of uploaded files

The PHP form variable $_FILES['file']['type'] does not return correct mime type, so we have to use some php functions like…….
> finfo_file()
> getimagesize()
> exif_imagetype()

if(version_compare(substr(PHP_VERSION,0,1),5) == -1)
{
$san	= finfo_open(FILEINFO_MIME);
$mime	= finfo_file($san,$FileName);
$tmpvar = explode(";", $mime);
finfo_close($san);
if($mime == "image/jpeg")
{
echo "this is jpeg";
}
else
{
echo "this is not jpeg";
}
}

One can use getID3 [http://getid3.sourceforge.net/] classes to get mime type other than images….

Don’t upload to a web accessible directory

Protect your directory to execute perticular file type by putting a .htacces file in directory

AddType text/plain .php .js .cgi

more help here:
http://www.askapache.com/htaccess/mod_rewrite-tips-and-tricks.html