Securing an Image Upload Script How well does this code limit security problems when uploading images to the server?

&lt;?php

$filename = $_FILE['inputfile']['name'];
$upload_path = 'images/';
//extract extension
$ext = strtolower(substr($filename, strrpos($filename, '.') + 1));

// return mime type ala mimetype extension
$finfo = finfo_open(FILEINFO_MIME_TYPE);

//get MIME type of the given file
$mime = finfo_file($finfo, $filename);
//close finfo
finfo_close($finfo);

if (is_uploaded_file($_FILES['inputfile']['tmp_name'])) {
    //first check: file extension and mime type
    if(!in_array($ext, array('jpeg', 'jpg', 'gif', 'png')) &amp;&amp; !in_array($mime, array('image/jpeg', 'image/gif', 'image/png')) ){
     die("Error1: Invalid Image type");
    }

    //create image according to MIME type

    //first: JPEG and JPG
    if($ext == 'jpeg' || $ext == 'jpg'){
       //move_uploaded_file ignored because no need to use it
       $im = @imagecreatefromjpeg($_FILE['inputfile']['tmp_name']);
       if($im){
          $createimage = imagejpeg($im, $upload_path.$_FILE['inputfile']['name']);
          if(!$createimage){
            die("Error3: Can't create image!");
          }
          //last check
          $filecontent = file_get_contents($upload_path.$_FILE['inputfile']['name']);

          //clean the file from any php code
          //changed
          while(preg_match('#&lt;\?php|\?&gt;|&lt;\?#i', $filecontent)){
            $filecontent = str_replace(array("&lt;?php", "&lt;?", "?&gt;"), "", $filecontent);
          }
          $handle = fopen($upload_path.$_FILE['inputfile']['name'], "wb");
          fwrite($handle, $filecontent);
          fclose($handle);
       }
       else{

        die("Error2: Invalid Image Detected");

       }
    }

}
?&gt;


Edit:

          while(preg_match('#&lt;\?php|\?&gt;|&lt;\?#i', $filecontent)){
            $filecontent = str_replace(array("&lt;?php", "&lt;?", "?&gt;"), "", $filecontent);
          }
This is a bad example of correcting user input:

$filecontent = str_replace(array("&lt;?php", "&lt;?", "?&gt;"), "", $filecontent);


I could still upload an image with the following comment in it:

&lt;?&lt;?phpphp echo "this code gets executed"; ??&gt;&gt;


because after your str_replace the comment would be

&lt;?php echo "this code gets executed"; ?&gt;


Instead of correcting user input, you should simply search for these strings reject and the image if it contains &lt;?. Why should you save the image anyway if you suspect an hacker attack? ;-)

Edit: This would be better

// test for opening php tags
// including asp-style opening tags (http://www.php.net/manual/en/ini.core.php#ini.asp-tags)
if(strpos($filecontent, "&lt;?") !== false || strpos($filecontent, "&lt;%") !== false) {
  // stop upload
}


Edit:
And one other thing I forgot to mention. Never use the original filename of the upload without validating it!

Because you could receive a request like this:

POST /upload.php HTTP/1.1
Host: localhost
Content-Length: 318
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryePkpFF7tjBAqx29L

------WebKitFormBoundaryePkpFF7tjBAqx29L
Content-Disposition: form-data; name="uploadedfile"; filename="../hello.jpg"
Content-Type: image/jpeg

&lt;?php echo "evil code"; ?&gt;
------WebKitFormBoundaryePkpFF7tjBAqx29L


And the "image" file gets saved in the directory above.

Better generate your own file names.