Check file type (FLV) before PHP upload file in temporary folder by reading only starting 3 bytes of file

Question

First 3 bytes of FLV file are signature "FLV". Now my question:

Is there any possibility in PHP to handle file uploads so that we can hook into the input stream of uploading file and check the first 3 bytes?

The scenario is i don't want the complete file to be uploaded (in temporary folder) and then check if the file is FLV or not, i just want to read first few bytes of uploading stream and if it is not "FLV" then return/exit.

The file needs to be uploaded by HTML based form. Can't rely on javascript,flash uploader or any client side validation workarounds i.e. need a pure PHP based solution.

I already know that PHP does not hand over control to our script until it finishes uploading file in temporary folder and populating global variables i.e $_POST $_GET $_FILES etc.

Also there is a somewhat similar question here: How to upload a file byte by byte in php

but answers does not satisfy my requirement/question.

Any ideas are really appreciated!

Thanks

Answer 1

First, set session.upload_progress.enabled in your php.ini.

Then, use session.upload_progress to track how many bytes have uploaded. Once you have reached the minimum threshold, check the temporary file being uploaded, it will be in $_SESSION[unique_key]['files'][0]['tmp_name']. If the file doesn't match, set $_SESSION[unique_key]["cancel_upload"] to TRUE, and the file will be rejected.

To get unique_key:

ini_get("session.upload_progress.prefix") . $_POST[ini_get("session.upload_progress.name")];

If the above does not work (I haven't tested it), then your only recourse would be to create your own custom handler for PHP either as an Apache module (or better, as a custom CGI application). There you could do your filtering.

Answer 2

@burhan-khalid provided a more up to date and correct answer above.

Short Answer is no with your constraints.

You can not access that file with PHP until it has been uploaded to the server. After it is uploaded you can read it but not before, at least not without some type of client side software that would allow you to stream it to PHP instead of the normal form submission.