File upload security with PHP - Header to text/plain

Question

I am using PHP to create a small script that uploads images to a server.

While going through the PHP documentation, I found a contribution from user CertaiN that gives a very clear example of how this script should look like: CertaiN's contribution. The code is, overall, very well explained, but the very first line of the script has no comment or explanation:

header('Content-Type: text/plain; charset=utf-8');

I browsed the internet and found no explanation for this command. My question is, therefore, the following: what is the exact purpose of this line in the protections against malicious uploads? Or is it completely unrelated to the rest of the script?

Answer 1

That line does not impact file upload security, it only sets the HTTP response mime type.

The reasoning I can see for the author using text/plain instead of text/html is simply that this script does not contain any actual HTML in the possible response messages.

Although the possible responses in this particular script do not echo any user input that I can tell, using text/plain as the response type instead of text/html would help to mitigate XSS in the page response, which could be possibly triggered via a combination with a CSRF attack from another site if the page did output anything using user input. This script does not protect against CSRF attacks.

Side note: this script does not actually validate that the files are valid images (mime checking is not sufficient). See the relevant Stack Overflow discussion EDIT: Actually, the script does an ok job at that.

You can use text/html if you want, just be careful with user supplied information.