upload only txt files

Question

how do check so ONLY .txt files are uploaded to the server and not other files in php.

Solution 1

You can test the filetype:

if ($_FILES['file']['type'] == 'text/plain') // this file is TXT

Also, you can verify the mime-type of a file using the function mime_content_type.

Solution 2

if(preg_match('\.txt$', $filename))

This will return true if the file ends with .txt

Solution 3

If you want to check the actual file MIME type, try PHP's finfo_file function. (See example #1 on that page. If the string returned isn't "text/html," then it's not a text file.)

Edit: Bear in mind that the mime_content_type function has been depreciated. Use finfo_file instead.

Comments

[sdot257]

but it could be a JPG file w/ a diff extension.

[CrociDB]

After the upload, use the mime_content_type function I posted.

[J V]

Any other method requires trusting the user or uploading the whole file first to find out. Besides, most browsers will just open it as a text file despite mime type

[ajreal]

@Alexander Girndt - @Jake is right, please don't assume *.txt is same as plain text file

[Powerlord]

finfo_file is only standard in PHP 5.3 and newer. Prior to this, you needed a PECL extension for it.

[www139]

Isn't it more secure to match the file type using preg_match instead of mime-type?

[The_Puzzler]

@www139 I'd say no because preg_match will be looking at the text which is there, and the extentions like .gif can easily be faked or have the file saved like that, which would mess up the result provided by preg_match. Checking mime types isn't a perfect solution but the extensions alone is a bad check