This is already fully covered in the answers to the following questions on this site:
Using file extension and MIME type (as output by file -i -b) combination to determine unsafe files?
How should I serve untrusted / unsanitized documents (PDF, DOC, XLS) to end users over the web?
Is it safe to serve any user uploaded file under only white-listed MIME content types?
Does X-Content-Type-Options really prevent content sniffing attacks?
What are the security risks of letting the users upload content to my site?
What steps should be taken to validate user uploaded images within an application?
Why should I restrict the content type of files be uploaded to my site?
How to defend vs. Image Remote File Inclusion, e.g. RFI using a .gif file (Apache/PHP)?
Check them out -- you'll find a wealth of great information there!