Secure image upload in php

Question

I am making an image upload function which I can re-use in my code, which has to be 100% secure. Please tell me if you can spot and security holes in my initial code;

<         


        

Answer 1

Stop filtering it by mime type it is not safe!

Client can send different mime types with different file extensions. So, you need to check file extension.

edit:

I think I have been misunderstood, I wrote the answer to tell that checking mime type to determine file type is not a good way, the best way to determine the file type is checking file extension. So, I don't mean that checking file extension is enough. Either checking only file extension or mime type is not safe way.

What to do? 1-Check mime type

2-Check file extension

3- decode file name

4- check file content consistency (if possible)

5- regenerate file content (if possible)

I know that attackers can bypass first and second way by using "null byte hack" and "mime type bypass"

So, 3,4 and 5 is so important for security.