title: How to prevent every malicious file upload on my server? (check file type)?
body: <p>my proble is to avoid that users upload some malicious file on my web-server.
  Im working on linux environment (debian).</p>
  
  <p>Actually the uploads are handled via php by this code:</p>
  
  <pre><code>function checkFile($nomeFile, $myExt = false){
  if($myExt != false){ $goodExt = "_$myExt"."_"; }else{ $goodExt = "_.jpg_.bmp_.zip_.pdf_.gif_.doc_.xls_.csv_.docx_.rar_"; }
  $punto = strrpos($nomeFile, '.');
  $ext = "_".substr($nomeFile, $punto, 8)."_";
  if(stristr($goodExt, $ext)){ return 1; }else{ return 0; }
  }
  </code></pre>
  
  <p>here i can specify the extensions allowed to be uploaded, and if the file dont meet them i delete as soon as the upload is completed.
  But this way let the user free to change the file extension with a simple rename.. and thats bad for me; even if a file.exe (for example) wont never be executed if is renamed in file.jpg (am i right?), i dont want to have potential danger files on my server.</p>
  
  <p>There is a way, in php, python, or whatelse can a unix system run easly, to check the truly type of a file?</p>
  
  <p>I've tried the python mimetypes module, but it retrieve the ipotetical mime-type of the file.. based on the extension -.-</p>