title: PHP safe upload system
body: <p>So I have this file upload system that is supposed to only accept the file types in $allowedExts but some guy keeps breaching the system with a file called angel.jpg.php. I think he has changed the mime type but I am still wondering how he breached the extension check.
  Help would be appreciated. Thanks in advance.</p>
  
  <pre><code>&lt;?php    
  $allowedExts = array("gif", "jpeg", "jpg", "png", "bmp", "doc", "pages", "docx",  "pdf","ppt","pptx","xls","xlsx");
  
  $temp = explode(".", $_FILES["file"]["name"]);
  $extension = end($temp);
  $extension2 = pathinfo($target_file,PATHINFO_EXTENSION);
  
  if (($_FILES["file"]["type"] == "image/gif")
  || ($_FILES["file"]["type"] == "image/jpeg")
  || ($_FILES["file"]["type"] == "image/jpg")
  || ($_FILES["file"]["type"] == "image/pjpeg")
  || ($_FILES["file"]["type"] == "image/x-png")
  || ($_FILES["file"]["type"] == "image/png")
  || ($_FILES["file"]["type"] == "image/bmp")
  || ($_FILES["file"]["type"] == "application/msword")
  || ($_FILES["file"]["type"] == "application/x-iwork-pages-sffpages")
  || ($_FILES["file"]["type"] == "application/vnd.openxmlformats-officedocument.wordprocessingml.document")
  || ($_FILES["file"]["type"] == "application/pdf")
  || ($_FILES["file"]["type"] == "application/vnd.ms-powerpoint")
  || ($_FILES["file"]["type"] == "application/vnd.openxmlformats-officedocument.presentationml.presentation")
  || ($_FILES["file"]["type"] == "application/excel")
  || ($_FILES["file"]["type"] == "application/vnd.ms-excel")
  || ($_FILES["file"]["type"] == "application/x-excel")
  || ($_FILES["file"]["type"] == "application/x-msexcel")
  || ($_FILES["file"]["type"] == "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet")
  &amp;&amp; in_array($extension, $allowedExts) &amp;&amp; in_array($extension2, $allowedExts) &amp;&amp; getimagesize($_FILES["file"]["name"])!=='FALSE')
  {
  // Upload file
  }
  
  else {
  // Do not upload file
  }
  </code></pre>