Verifying file type of ANY upload

I read that for images, it's not safe to depend on the file extensio开发者_如何学运维n and that it's better to try to open the php with an image library like gd to verify its extension.

What about other types of files? If I have a .doc or .pdf or any other file type, how can I really tell the file type is really what it claims it is?

If you are on a *nix system the file command does a pretty good job at guessing mime type. It is not perfect, and fails on 'nested' types like .tar.gz but it is pretty good.

As i understand it Fileinfo uses the same magic numbers approach as file without needing to go to the shell...

I don't know if it works for any file type, but you can check mime type using mime_content_type or filetype.