I don't want it to just check the extension of the file as these can easily be forged even MIME types can be forged using tools like TamperData.
So is there a better way to check file types in PHP ?
You want PHP's Fileinfo functions, which are the PHP moral equivalent of the Unix 'file' command.
Be aware that typing a file is a murky area at best. Aim for whitelist ("this small set of types is okay") instead of blacklist ("no exes, no dlls, no ..."). Do not depend on file typing as your sole defense against malicious files.
Files have signatures or "magic numbers" embedded in them, usually near the beginning of the file. libmagic is a library which extracts a files signature and looks it up in a signature database.
This is the way Unix type systems determine file types i.e. if you save a text file without an extension on Linux it will still automatically open with a text editor.
Systems like Windows on the other hand only look at file extension. Opening a text file with no extension on Windows will result in a WTf-is-this popup window.
So there are merits in checking both the extension and the magic number since your website will likely have visitors with different operation systems.
There is no conception of file type. In computer world everything is a bunch of 0/1 and whether it is and image or a lot of random characters depends on how do you interpret your zeros and ones. File type (as an extension like .docx, .png) are just for the convenience of the user to be able to do an educated guess of what can it be and to open it with a proper tool. As with any guess, it can be wrong.
So instead of trying to play around with techniques like suggested fileinfo, if I were you, I would rather figure out what do I allow people to upload.
So if you allow people to upload images, use getimagesize and may be even check that the width height is in appropriate range (who knows may be someone will upload an image like 500.000 pixels width/height and your server will die while resizing it. Its a valid image, but still not what you want). May it make sense to resize every image and only serve resized formats and store somewhere untouchable originals.
If you decide that users can upload .mp3 files, take a look at something that can deal with these sort of files. Who knows may be there are already tested methods to check whether this is really mp3 file.
Regarding of what you decide, use something to mitigate possible problems (assuming that the person upload a file
You can parse the files with a specific parser which throws an exception when the file is not really what it waits... Anything else can be falsified I think.
What really matters by file upload is
and so on...
I wrote an even more detailed answer on stackoverflow about PHP uploads, maybe it helps.
Salvador Dali has some very good suggestions with regards to images. 1 thing however that he is missing. It is possible for an image to show as perfectly valid however contain malicious code. This for example can be placed after the end of image marker (0xFF, 0xD9). 1 potential way to get around this is to re sample the file using something like GD. It used to be quite common for avatar and signature uploads to be taken advantage of in forums. Someone would upload their image which will display as normal but will also contain code that could infect the users PC with malware.
The same is probably also true for MP3's and other file types.