PHP occasionally fails to identify WORD doc

[quasi]

I have a site where users can post files. In one section they are allowed to post a pdf or a word doc. PHP is checking this. Occasionally I'm getting complaints that it is not recognizing word docs. Are there several different filetypes associated with word docs?

[coopster]

What do you mean it is not recognizing word docs? Are you checking the filename extension upon upload and denying the upload if it doesn't meet certain criteria? Could you offer a bit more explanation?

[quasi]

Sorry, I'm checking the filetype:

if(($_FILES['mapFile']['type']!="application/msword") && ($_FILES['mapFile']['type']!="application/pdf")
{
die ("$user, File must be a pdf or Word doc! ");
}

Has worked 100% for pdf about 70% for word docs.
I printed out the filetype on a doc that had failed hoping to see something different but the the file type was correct.

[quasi]

I have acquired two documents from different users who have reported the problem to me. I attempted to upload the documents expecting an error and they both loaded fine.
Do some browsers not send a datatype with a file?

[mcavic]

I attempted to upload the documents expecting an error and they both loaded fine.
Do some browsers not send a datatype with a file?

That's the most likely explanation, that it's a browser problem. However, if you're in Linux, you can run the 'file' command on the uploaded document, and it'll tell you if it's Office or PDF.

[coopster]

Do some browsers not send a datatype with a file?

Yes, that is possible. I just wanted to confirm this for you. If you haven't read through Handling file uploads [php.net] yet you really should. It is a must read for PHP developers. From that page ...

$_FILES['userfile']['type']

The mime type of the file, if the browser provided this information. An example would be "image/gif". This mime type is however not checked on the PHP side and therefore don't take its value for granted.

[quasi]

I am using a Linux server.
But I can't use the 'file' command until the doc is already uploaded. That defeats the purpose. Are there any other options?
Oh, and why would a pdf get identified and not a word doc?

[mcavic]

I can't use the 'file' command until the doc is already uploaded.

You can save the file to a temp directory (I think that happens automatically) and validate it before returning a success or failure to the user.

There isn't another way. You have to either trust what the browser says for the file type, or check it yourself after uploading it. And trusting the browser isn't a good idea.

[quasi]

Thanks for the information. I'll go ahead and recode. It does load to a temp dir by default.
I've been trying to find a listing of file types that the 'file' command identifies, can't find one. I ran it against word and pdf file to get:

$ file LOST.doc
LOST.doc: Microsoft Office Document

$ file 1748.pdf
1748.pdf: PDF document, version 1.3

Would there be any variations of these strings, other than the version number of the pdf?

[mcavic]

The definitions are listed in a file called magic -- usually in /etc or /usr/share.

You can probably look for Microsoft Office, Microsoft Word, or PDF in the output.