How to restrict file upload using PHP?

The browser uploading the file probably doesn't know it's an application/dbf mime-time, and sends it as the generic "application/octet-stream". The client/browser has to set the mime-type to be known on upload, and this can be altered by the user!

Thus MIME-type isn't reliable. If you want to be sure that it's the correct file-type/format, you'll have to examine the uploaded file.

There is another easy way for this problem , instead of inspecting the MIME type, we can get the file extension of the uploaded file by using this function.

$filename=$_FILES["file"]["tmp_name"];   
 $ext = pathinfo($filename, PATHINFO_EXTENSION);
 $ext = strtolower($ext);

 if($ext=="png"||$ext=="gif"||$ext=="jpg"||$ext=="jpeg"||$ext=="pdf"
        ||$ext=="doc"||$ext=="docx"||$ext=="xls"
        ||$ext=="xlsx"||$ext=="xlsm"||$ext=="dbf")
    {
        // your code whatever you want to write;

     }

Find an easy blob-upload and download of file here Blob-upload

Defining the content type is up to the browser (or other client application), making it easy to tamper with and cannot be relied upon. My guess is that your browser doesn't recognize the .dbf file and defaults to "application/octet-stream".

You can't depend on the type field of a file upload to actually determine its type. First, it can be spoofed by the client. Secondly, the client simply might not know what the file type actually is and just report 'application/octet-stream' instead.

you'll have to determine what kind of file was uploaded yourself. Fortunately, PHP provides the fileinfo extension, which can help you with determining the type of a file.

Code example based on one from php.net:

<?php
$finfo = finfo_open(FILEINFO_MIME_TYPE); // return mime type ala mimetype extension
echo finfo_file($finfo, $_FILES["file"]["tmp_name"]) . "\n";
finfo_close($finfo);
?>

http://www.php.net/manual/en/ref.fileinfo.php

Try inspecting the MIME type being passed to you when you upload a file of that type. Insert a temporary print $_FILES["file"]["type"]; somewhere in your code, then upload the file to run the code and see what it prints out! You can then copy that type and use it in your if-statement.