How to check if uploaded files are mp3?

[Louigi Verona]

Searched and searched on the subject, read the mp3 format specifications but found nothing.

[Phill Pafford]

validate the extension .mp3

preg_match

[Louigi Verona]

I am afraid that might not be enough. I need to insure the file is a streamable mp3 file. Otherwise someone might just rename a jpg into mp3 and do the upload.

[TJ111]

Use mime_content_type to test the actual mimetype as determined by the mimetype field written in the first few bytes of the file. Of course these can be spoofed, but it's more secure then just using regular expressions.

$uploaded = 'some_file.mp3';
//from http://www.webmaster-toolkit.com/mime-types.shtml
$mp3_mimes = array('audio/mpeg3', 'audio/x-mpeg-3'); 

if (!in_array(mime_content_type($uploaded), $mp3_mimes)) {
  echo "not a valid mp3";
} else {
  do_whatever();
} 

[Fang]

Fileinfo

[SyCo]

When the file is uploaded you have the $_FILES array containing the file information. print_r($_FILES) and you 'll see what it contains.

One of the array keys is 'type'. That's the mime type of the file. So where the name can be changed the type is read from the file data.

$_FILES['uploadedfile']['type']

Rename the file with mp3 extension to be sure it's both the type, and has the mp3 extension you want.

I would validate by creating an array of mp3 mime types

I think this is current but do some research to check

audio/mpeg
audio/x-mpeg
audio/mp3
audio/x-mp3
audio/mpeg3
audio/x-mpeg3
audio/mpg
audio/x-mpg
audio/x-mpegaudio

(list taken from http://filext.com/file-extension/MP3)

Then compare the files type to see it is in the array (using inarray() )

If it is continue moving it to the server if not exit with a message to the user.

If you get complaint from users in the future (after you have it working for a while) that they can't upload first thing to check is no new mime types have been created. This happened recently with Microsoft's new XML office doc types and the acceptable mime types array had to be updated for acceptable office docs.

[Louigi Verona]

For some unknown reason mime content type doesn't work. mime debug IS switched on in php.ini

Use mime_content_type to test the actual mimetype as determined by the mimetype field written in the first few bytes of the file. Of course these can be spoofed, but it's more secure then just using regular expressions.

$uploaded = 'some_file.mp3';
//from http://www.webmaster-toolkit.com/mime-types.shtml
$mp3_mimes = array('audio/mpeg3', 'audio/x-mpeg-3'); 

if (!in_array(mime_content_type($uploaded), $mp3_mimes)) {
  echo "not a valid mp3";
} else {
  do_whatever();
} 

[TJ111]

Read this comment (and the one below it) from the php website and see if they help you at all. http://us3.php.net/manual/en/functio...type.php#79166