php - Is this regular expression vulnerable to arbitrary file upload? -

i'm busy coding php file secure file uploading of images such .jpg, .jpeg, .png, .bmp, , .gif

here code:

$realname = $_files['userfile']['name'];  if(!preg_match("/(\.jpg|\.png|\.gif|\.bmp|\.jpeg)$/i",$realname)) {           die(); } 

is there way bypass check able upload .php file? i've heard of file.php%00.jpg trick, secured from. know of other methods? or code above safe?

to answer question: yes.

but you're in luck, wrote this:

function checkimagefileisimage($filepath) {     $type = exif_imagetype($filepath);     $allowedtypes = array(         1,  // [] gif         2,  // [] jpg         3   // [] png     );      if (!in_array($type, $allowedtypes)) {         return false;     }     return true; } 

take @ http://php.net/manual/en/function.exif-imagetype.php more file types.