title: Is HttpPostedFile.ContentType a flawless way to validate an uploaded file?
body: <p>I want to validate the file type to make sure the user is uploading an image of type JPEG, GIF, or PNG. Instead of checking the file extension, I figured using HttpPostedFile.ContentType would be safer since it checks the MIME content type.</p>
  
  <pre><code>protected void cvValidateImageType_ServerValidate(object source, ServerValidateEventArgs args)
  {
      if (fupImage.HasFile)
      {
          args.IsValid = (fupImage.PostedFile.ContentType.ToLower() == "image/jpg" ||
                          fupImage.PostedFile.ContentType.ToLower() == "image/jpeg" ||
                          fupImage.PostedFile.ContentType.ToLower() == "image/pjpeg" ||
                          fupImage.PostedFile.ContentType.ToLower() == "image/gif" ||
                          fupImage.PostedFile.ContentType.ToLower() == "image/x-png" ||
                          fupImage.PostedFile.ContentType.ToLower() == "image/png");
  
      }
      else
          args.IsValid = true;
  }
  </code></pre>
  
  <p>Is this a flawless way to check the file type, or can it be fooled?</p>