如何删除不是图像的文件？

Question

I wrote this code to store an image and avoid that someone store a malware or other files different from an image:

$content = file_get_contents($image);
file_put_contents($path, $content);

// Check imagesize to know if it is an image or not:
$sizeimage = getimagesize(dirname(__FILE__)."/".$path);
if($sizeimage[0]<10000){ echo "ok"; }else{ unlink(dirname(__FILE__)."/".$path); }

I tried to insert another files like a CSS file and it store the CSS in the database.

Why ? What is wrong in my code ?

Answer 1

In case the image file is invalid, $sizeimage[0] returns 0 (check PHP documentation).
Hence, the following statement also validates true in case the file is no valid image:

if($sizeimage[0]<10000)

Consider using the following statement:

if($sizeimage[0]>0 && $sizeimage[0]<10000)

This only validates true when getimagesize() found an image that's smaller then 1000 pixels.