Validate Uploaded Image using WordPress' Built-in Functions?

Question

I have a form that allows users to upload an image. I'm using the code below (which currently doesn't work) to ensure what a user uploads is valid.

Can someone help me out and either update my code or point me in the right direction as to how I can use as many of the built-in WordPress functions (wp_check_filetype_and_ext()), or anything else that would be well-suited, to handle the validation as possible? It also must be secure to prevent any malicious files, attacks, etc.

if ( $_FILES ) {
  foreach ($_FILES as $file => $array) {
    //Check if the $_FILES is set and if the size is > 0 (if =0 it's empty)
    if ( isset( $_FILES[$file]) && ($_FILES[$file]['size'] > 0 ) ) {
      $tmpName = $_FILES[$file]['tmp_name'];
      list($width, $height, $type, $attr) = @getimagesize($tmpName);

      if ($width != 500 || $height != 500) {
        $error .= "Image is to small<br />";
        unlink($_FILES[$file]['tmp_name']);
      }

      // Get the type of the uploaded file. This is returned as "type/extension"
      $arr_file_type = wp_check_filetype(basename($_FILES[$file]['name']));
      $uploaded_file_type = $arr_file_type['type'];

      // Set an array containing a list of acceptable formats
      $allowed_file_types = array('image/jpg','image/jpeg','image/gif','image/png');

      // If the uploaded file is the right format
      if (in_array($uploaded_file_type, $allowed_file_types)) {
      } else { // wrong file type
        $error .= "Please upload a JPG, GIF, or PNG file<br />";
      }
    }
  }
}

Answer 1

All of the code in your question can be replaced with:

require_once( ABSPATH . 'wp-admin/includes/image.php' );
require_once( ABSPATH . 'wp-admin/includes/file.php' );
require_once( ABSPATH . 'wp-admin/includes/media.php' );
if ( $_FILES ) {
  foreach ($_FILES as $file => $array) {
    $image_post_id = media_handler_upload( $file );
    if ( is_wp_error( $image_post_id ) ) {
      $error .= $image_post_id->get_error_message();
    } else {
      // $image_post_id now holds the post ID of an attachment that is your uploaded file
    }
  }
}

The power of media_handle_upload means that now you have now completely outsourced your security, checking, and uploading to WordPress Core. media_handle_upload will be maintained long after you've finished your project, by people who are far smarter than either of us, and other people with a vested interest in keeping WordPress secure.

media_handle_upload will do all of the checking you get when you upload things via the dashboard, and will create attachment posts to represent these uploaded files in the database. It will also handle the creation of different image sizes, and compatibility with plugins, and respect the security settings specified in the dashboard.

If successful, it will return the ID of the attachment post it created. If unsuccessful, it will return a WP_Error object with an error message.

You can then use wp_get_attachment_url if you need the full URL of the attachment, or wp_get_attachment_image_src if you need to get a particular size for the image, e.g.:

$image = wp_get_attachment_image_src( $image_post_id, 'thumbnail' );
if ( $image != false ) {
    echo $image[0];
}