Php图像验证

Question

Thus anyone has any idea why this code is not working for me

$type1 = $_FILES['textfield2']['type'];
$type2 = $_FILES['textfield3']['type']; 

if($type1 == 'image/gif' || $type1 == 'image/png' && $type2 == 'image/gif' || $type2  == 'image/png')
{
    echo 'Valid';
    echo $type1.'<br />'.$type2;
}
else
{
    echo 'Invalid';
}

If i select 1st file as a zip or any other format and then next as png it is going to valid that what i should not

Answer 1

PHP's operator precedence makes && bind tighter than ||, so your test is coming out as:

if($type1 == 'image/gif' || ($type1 == 'image/png' && $type2 == 'image/gif') || $type2  == 'image/png')
                            ^----------------------------------------------^

Beyond that, do not use the user-provided ['type'] data for this. It's utterly trivial to forge, and someone can set to 'image/gif' while uploading nastyvirus.exe.