using getimagesize() to determine whether a file is an image

Would calling getimagesize() on a file and checking if the returned value differs from false suffice to determine whether or not a file is an image?

Are there any other possibilities to determ开发者_如何学运维ine if a file is an image in php, solutions that are more foolproof than simply checking the extension.

getimagesize() is a pretty reliable indication that the file is an image, yes.

It will determine if the image appears to have a valid header.

It (usually) won't determine if there is any corruption in the actual image data, which may show up as a messed up image or an error part way through loading the image.

You may also keep in mind that it is possible for a file to be a valid image file but also to conceal other data - either within metadata, image data, or after the end of the image data. So while getimagesize() may tell you you have a valid image, it doesn't necessarily mean the file isn't also valid as another type. Since JAR and ZIP files read from the end of the file, it's possible for a file to be both a valid image and a valid JAR/ZIP file, and JAR files are executable in a browser - the basis of the GIFAR exploit.

It would suffice to find out whether it's one of the supported file formats, yes. It actually parses the header bytes of the file, and is therefore very reliable.

It's the best method to use that is built into PHP.

Advanced tools like ImageMagick's identify command do essentially the same - consider them only if you need to support many more file formats than those supported by getimagesize() (their list is here, in the IMAGETYPE_* constants).