How to protect upload php files against shell script

Question

How can I protect sending php files against shell script, knowing that I only accept one type of extension.

Answer 1

Instead of checking the extension you can check the contents using the PHP API called fileinfo, as I showed in this reply /a/73497/3635

Note that in PHP5.3 (although rare some servers still use it) we did not have Fileinfo, but we had mime_content_type (in the documentation does not speak if it is in disuse), so I put as fallback, if a function is available use it, if it does not try the oldest, however both always see enabled.

Example:

<?php

function mimeType($file)
{
    $mimetype = false;

    if (class_exists('finfo')) {//PHP5.4+
        $finfo     = finfo_open(FILEINFO_MIME_TYPE);
        $mimetype  = finfo_file($finfo, $file);
        finfo_close($finfo);
    } else if (function_exists('mime_content_type')) {//php5.3 ou inferiror
        $mimetype = mime_content_type($file);
    }

    return $mimetype;
}

//Libere aqui os tipos permitidos
$validos = array( 'image/jpeg', 'image/png', 'image/gif', 'text/plain' );

$location = 'uploads/';
$arquivo = $_FILES['file'];

if ($arquivo) {
    $name = $arquivo['name'];
    $tmp_name = $arquivo['tmp_name'];

    if ($_FILES['file']['error'] !== UPLOAD_ERR_OK) {
        echo 'Erro ao fazer o upload:', $error;
    } else {
        //Pega o mimetype
        $mimeType = mimeType($tmp_name);

        //Checa o mimetype com o array
        if (!in_array($mimeType, $validos)) {
            echo 'Formato de arquivo invalid';
        } elseif (move_uploaded_file($tmp_name, $location . $name)) {
            echo 'Upload completo';
        }
    }
}