File Extension Validation

Question

Hi,
I've created an upload form which is all working fine.
To reduce coding I've given the user an option of chosing the type of file they want to upload, once they've cliked on the chosen file type a URL parameter is past stating the file type.
What I want to do is have an error message is the string of the upload file doesn't contain the extension that matches the file extension.
I had a stab in the dark with this coding but it doesn't work and I can see why.
$error = array();
$pos = strpos($_GET['type']);
if ($pos === false) {
          $error['urlError'] = 'This is not a JPG, please reload the upload page and chose the correct file format';
//If no errors, process form//End Error Messages
if (!$error) {
if ((isset($_POST["MM_insert"])) && ($_POST["MM_insert"] == "form2")) {
  $insertSQL = sprintf("INSERT INTO files (ID, username, file_type, url, `date`, Uploader, email) VALUES (%s, %s, %s, %s, %s, %s, %s)",
                       GetSQLValueString($_POST['ID'], "int"),
                       GetSQLValueString($_POST['username'], "text"),
                       GetSQLValueString($_POST['file_type'], "text"),
                       GetSQLValueString($_FILES['url']['name'], "text"),
                       GetSQLValueString($_POST['date'], "text"),
                       GetSQLValueString($_POST['Uploader'], "text"),
                       GetSQLValueString($_POST['email'], "text"));
etc
Any ideas would be much appreciated.
Cheers

Answer 1

declare
-- Local variables here
CURSOR c_get_file IS
     select t.blob_content from sr_docdb.document_upload t
WHERE t.name = 'F24972/Test.docx';                     
          v_content BLOB;
          v_amount INTEGER := 8; --8 bytes
     v_offset INTEGER := 1;
     v_file_header RAW(100);
     v_docx_binary RAW(20);
     v_docx_char CHAR(30);
begin
-- Test statements here
SELECT a.magic_number --Data type is RAW
     INTO v_docx_binary FROM document_extension_amy a
     WHERE a.document_extension_id = 8;
     htp.p('v_focx_binary: '||v_docx_binary); htp.br;
     OPEN c_get_file;
     FETCH c_get_file INTO v_content;
     CLOSE c_get_file;
     dbms_lob.read(lob_loc => v_content, amount => v_amount, offset => v_offset, buffer => v_file_header);
     htp.p('v_file_header: '||v_file_header);
--This section can be made as a function
     IF V_FILE_HEADER = v_docx_binary THEN
          HTP.P('DOCX');
          ELSE
          htp.p('OTHERS');
          END IF;
end;
This is a .tst file. The principal is to read from the BLOB content and compare that with the HEX value of DOCX. But for other file types, it is similar but may not be the same. As some files have the unique magic number of not 8 bytes.
and like .JPG, the magic number is FF D8 FF E0 xx xx 4A 46 49 46 00. the xx xx can be any hex value.
Is there anything that needs improvements? Please point out! Many thanks!