Business Owner / Chief Developer

Richard Korts

<div>
Anything driven by MIME types is basically going to be looking at the extension. If someone intentionally messages with the extension, then the MIME type will be detected incorrectly. Plus, at that point, you could just check the file extension yourself. The MIME content type functions are useful mostly when determining what headers to send when the data is being downloaded later on, so the browser knows how to handle the data.<br><br>If you want to actually validate the file content, there's only so much you can do. For example, it's hard to detect a PDF file that has some corrupted data, BUT you can check the file signatures to make sure that the first few bytes of the file are correct.<br><br>For all PDF files, the first 4 bytes of the file should be (hex chars) 25 50 44 46.<br><br>Older Office documents like .doc and .xls are proprietary formats, so they'll have these file signatures:<br>.DOC file - at offset 0x200 (512 bytes in), you should have these 4 bytes: EC A5 C1 00<br>.XLS file - at offset 0x200 (again, 512 bytes in), you should have these 4 bytes: FD FF FF FF<br><br>Modern Office documents are simply ZIP files that have had their extensions renamed from .zip to .xlsx or to .docx, so if you look at the first 8 bytes of the file, you should see the file signature of a ZIP file - these bytes: 50 4B 03 04 14 00 06 00 <br><br>The only way to really distinguish .DOCX and .XLSX files from .ZIP files is to actually unpack them in memory (use a PHP extension that can read ZIP files), and then look to see if they have some common folders in the root of the ZIP: the "_rels" folder and the "docProps" folder. If you have those 2 folders, then it's a pretty high confidence level that it's a Word or Excel document. If you want to know which, Word documents will have a "word" folder in that same root of the ZIP file, and Excel documents will have an "xl" folder.<br><br>
</div>


<div>
And if you want to add support for more file types/signatures, this is a pretty good source:<br><a href="https://www.garykessler.net/library/file_sigs.html" rel="ugc">https://www.garykessler.net/library/file_sigs.html</a>&nbsp;<br><br>...but there are plenty of other sources if you Google for file signatures.
</div>


<div>
I stand corrected - you are correct, lenamtl. The FileInfo extension does indeed do some analysis of the file contents, and is probably better than what I have above.
</div>


<div>
<div class="content wysiwyg-content">
We want to allow applicants to upload a resume but we want to make sure it is either a pdf or a MS Word (.doc or .docx) file.<br />
<br />
Some have submitted docs that have a pdf extension but cannot be opened with Adobe pdf reader.<br />
<br />
Is there a tool that can be used, preferably in php to validate that a document is, in fact, one of the required types?<br />
<br />
Thanks
</div>
</div>


We want to allow applicants to upload a resume but we want to make sure it is either a pdf or a MS Word (.doc or .docx) file.

Some have submitted docs that have a pdf extension but cannot be opened with Adobe pdf reader.

Is there a tool that can be used, preferably in php to validate that a document is, in fact, one of the required types?

Thanks

Need ability to verify document type

A Portable Document Format (PDF) is a file format consisting of an electronic image resembling a printed document and can be viewed, printed, and electronically transmitted. PDF files can store various types of data, including formatted text, vector graphics, and raster images. The page layout defines the location, size, and shape of each page and each item on the page. The information looks the same no matter what device or program is used to open it.

PHP is a widely-used server-side scripting language especially suited for web development, powering tens of millions of sites from Facebook to personal WordPress blogs. PHP is often paired with the MySQL relational database, but includes support for most other mainstream databases. By utilizing different Server APIs, PHP can work on many different web servers as a server-side scripting language.

Microsoft Word is a commercial document editing program that is part of the Microsoft Office suite. It features numerous text-editing tools for creating richly formatted documents, along with tools for the use of macros in Word documents. Word's native file formats are denoted either by a .doc or .docx file extension. Plugins permitting the Windows versions of Word to read and write formats it does not natively support, such as the OpenDocument format (ODF) are available. Word can import and display images in common bitmap formats such as JPG and GIF. It can also be used to create and display simple line-art.