PHP Upload File Extension Security - php

Question

im currently using that codes in my software, is it safe to check files extensions or are there any way to bypass it?
$ext = explode('.',$_FILES['file']['name']);
$extension = end($ext);
if($extension == 'jpg' || $extension == 'png' || $extension == 'JPG' || $extension == 'jpeg' || $extension == 'gif' || $extension == 'pjpeg' || $extension == 'x-png'){
$extension = $extension;
}
else {
echo 1;
die();
}
Thank you..

Answer 1

are there any way to bypass it?
One way to bypass it, is to simply rename the file..
After all, you currently just check for file name parts.
To handle image uploads securely, OWASP suggests using a re-write approach.
In PHP you could do so by loading the image with gd or imagick and saving a new image based on the input. It may sound like a relatively useless step, but it's a pretty safe way to be sure you're actually dealing with an image.
Edit: See also this answer.

Answer 2

I personally would not recommend just checking file extensions alone. Couple points you need to consider based on your current approach:
Imagine, if I upload a file called mypicture.jpg.php would your current if statement logic catch that out? Might be worth a test?
Following (1) if answer was no, then next question would be does your application check if any php code is contained inside the jpg image which could lead to various privilege escalations on the webserver?
Thus, following the previous answer from Stratadox I would also read this OWASP Unrestricted File Upload page. The OWASP link kindly provided by Stratadox focuses more on prevention techniques and the link I provided is more the attacking side. I think combined together this should help.
In summary, you could keep the current file extension checks but maybe expand few more advanced checks inside the if statement. Good suggestion already mentioned above is native PHP image checking functions/libraries e.g. gd or imagick.
NOTE - always research any native PHP image checking functions/libraries for security flaws (Google will help) and ensure you are configuring functions/settings correctly. This is a good practice to get into to make you a more security minded developer (and make some big $) :)
Hope this helps.

Answer 3

The best way is that:
<?php //A function to return the extension if you'll want use IT
function EXTENSION($sr){
$path_parts = pathinfo($sr);
$exte='.'.$path_parts['extension'];
return $exte;
;}
;?>
<?php
//OR Other way
// then test if is a Pic
list($width, $height, $type, $attr) = getimagesize($_FILES["file"]['tmp_name']);
if(preg_match("#.jpg|.jpeg|.png|.gif#i", $_FILES['file']['name']) AND $width > 2 ){
//Do what you want
;}else{
echo 1;
die();
;}
;?>
it very safe like this Bro.