I have a website that uploads documents to the server and insert them into Mysql tables.
In the process the server (via PHP) examns the type of the file to decide whether rejecting it or save it, and I do this via posting the
$_FILES["file"]["type"]
and be sure it equals to:
application/vnd.openxmlformats-officedocument.wordprocessingml.document
However, in some cases the posted file type appeares to be:
application/octet-stream
Is this because the client doesn't have MS Word installed on the device?
If this is the case, is it NOT safe to verify application/octet-stream to be one of the allowed file types? given that it's for generic MIME as per my understanding; which means any file type including .exe would be allowed? (it goes without saying what issues would this cause).
Is there some other way to validate the file type .docx even if no MS Word installed? or whatever the reason behind such? I have seen other websites allow uploading .docx files even from mobile devices that don't have such installed.
Thanks for the help.