We have developed an application with contain file upload functionality. We use that application for internal purpose only. We use core php language.

We already use the below validations:

  1. File extension checks (allow only CSV, txt, SQL).

  2. File size checks (allow only 50 MB). We allow bulk upload as well.

  3. MIME Type.

We are planing to check the file content as well for malicious file upload. How do we do that?

  • Unfortunately, we can't help with the "libarary" part of your question.
    – schroeder
    Commented Dec 5, 2019 at 20:03
  • Why not just run anti-virus/malware on the file upload folder?
    – schroeder
    Commented Dec 5, 2019 at 20:05

1 Answer 1


That depends entirely on the file in question.

For example, if you want to enable users to just upload plain text files, then it may be enough to check if there are any unprintable characters in the file.

If you allow users to upload images, you have to make sure that the files are actually images. This is best done with tools like ImageMagick.

This list goes on and on, and depends exactly on what files you want to allow. If you want to allow arbitrary files, then you can't make any file type checks.

What not to do

Never go for file extensions, MIME type or naive magic numbers. File extensions can be changed trivially, even by less experienced users. MIME types can be evaded by any even moderately experienced attacker, just like magic numbers.

  • Only CSV, txt, SQL allowed
    – schroeder
    Commented Dec 5, 2019 at 20:04
  • @schroeder Weird. I must have read past that. Let me edit
    – user163495
    Commented Dec 5, 2019 at 21:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .