I know that my question has been responded lot of times, but most the responses addresses functions that I don't even use (like use include with images) and that makes me worry because maybe I'm not doing something that I should be doing.
When I'm validating the images, I first check for the size (2MB or less) and then check the extension of the file using:
$Whitelist are the extensions that I allow (only jpg, jpeg and png). After that I use
getImageSize to verify that is really an image and if all the 3 conditions are met, then I create a new name for the image, add ".jpg" and then save it in an image folder (I don't know if this is important, but I also create a smaller version of the image to show in the page and if you want to see it in full size, you must click it and see the original image in a new tab).
The only thing I do with these images is show them with img src="" on my website, I never include images (actually I don't even know why some people do this [not criticizing, I'm being serious]) or use fopen and similar functions and the images folder can't execute php code.
Is that enough to not execute php code included in the images?
I must do something about possible images with virus? I think the size restriction, add a new name and always make sure to add .jpg at the end of the new name help me to mitigate this, but I'm not really sure.
I'm new with uploaded content and that's why I feel really paranoic about this (and all kind of user inputs... it's like being inside a pyramid where everything is cursed), so I'll really appreciate all the responses.