wp_check_filetype_and_ext( string $file, string $filename, string[]|null $mimes = null ): array

Description

Compatibility

Present in every tracked release (6.7.7 to 7.1.0), and compiles on PHP 7.4 through 8.6-dev.

Parameters

$filestring

Full path to the file.

$filenamestring

The name of the file (may differ from $file due to $file being in a tmp directory).

$mimesstring[]|nulloptional

Array of allowed mime types keyed by their file extension regex.
Defaults to the result of get_allowed_mime_types().Default: null

Return value

array

Values for the extension, mime type, and corrected filename.

• $extstring|false

  File extension, or false if the file doesn't match a mime type.

• $typestring|false

  File mime type, or false if the file doesn't match a mime type.

• $proper_filenamestring|false

  File name with its correct extension, or false if it cannot be determined.

Performance profile

How much work a call to wp_check_filetype_and_ext() does, and what it touches: the algorithmic scaling, the Zend instruction count per call across PHP versions, the hooks it hands control to, and the core code that calls it. Measured from the compiled opcodes, not a stopwatch, so every number is identical on any machine running the same PHP version, and every function in core is ranked by cost.

Cost class

Heavy

Reads or writes the filesystem via file_exists().

Scaling

Scales with input

The body loops, so the work grows with what you pass in.

Instructions

23–128

Executed per call on PHP 8.5, depending on the branch taken. The body compiles to 179.

Plugin surface

2 hooks

Third-party callbacks on 'getimagesize_mimes_to_exts', 'wp_check_filetype_and_ext' run inside this call, and their cost is not bounded by anything here.

Called by

4

4 places in core call this, so the cost is paid more often than your own code shows.

What it touches

• hookthird-party callbacksapply_filters()called directly
• filesystemfilesystem accessfile_exists()called directly

Further down the call graph this can also reach query. That is the worst case, several calls deep and usually down an error path, not what a normal call pays.

What one call costs · 33 distinct outcomes

One number would be a lie: the work depends on which branch runs. These are every distinct cost wp_check_filetype_and_ext() can have, taken from its control-flow graph on PHP 8.5.

Hooks and filters fired · 2

2 hooks fire while wp_check_filetype_and_ext() runs, in this order:

1. 1
   apply_filters( getimagesize_mimes_to_exts )filterline 3159 (+35 into the body)

   Filters the list mapping image mime types to their respective extensions.

2. 2
   apply_filters( wp_check_filetype_and_ext )filterline 3352 (+228 into the body)

   Filters the "real" file type of the given file.

Uses · 5

• wp_check_filetype()Retrieves the file type from the file name.
• str_starts_with()Polyfill for `str_starts_with()` function added in PHP 8.0.
• wp_get_image_mime()Returns the real mime type of an image file.
• apply_filters()Calls the callback functions that have been added to a filter hook.
• get_allowed_mime_types()Retrieves the list of allowed mime types and file extensions.

Used by · 4

• Custom_Background::handle_upload()Handles an Image upload for the background image.
• Custom_Image_Header::step_2_manage_upload()Uploads the file to be cropped in the second step.
• _wp_handle_upload()Handles PHP uploads in WordPress.
• wp_ajax_upload_attachment()Handles uploading attachments via AJAX.

Source code

View on Trac ↗View on GitHub ↗

3124function wp_check_filetype_and_ext( $file, $filename, $mimes = null ) {3125	$proper_filename = false;3126 3127	// Do basic extension validation and MIME mapping.3128	$wp_filetype = wp_check_filetype( $filename, $mimes );3129	$ext         = $wp_filetype['ext'];3130	$type        = $wp_filetype['type'];3131 3132	// We can't do any further validation without a file to work with.3133	if ( ! file_exists( $file ) ) {3134		return compact( 'ext', 'type', 'proper_filename' );3135	}3136 3137	$real_mime = false;3138 3139	// Validate image types.3140	if ( $type && str_starts_with( $type, 'image/' ) ) {3141 3142		// Attempt to figure out what type of image it actually is.3143		$real_mime = wp_get_image_mime( $file );3144 3145		$heic_images_extensions = array(3146			'heif',3147			'heics',3148			'heifs',3149		);3150 3151		if ( $real_mime && ( $real_mime !== $type || in_array( $ext, $heic_images_extensions, true ) ) ) {3152			/**3153			 * Filters the list mapping image mime types to their respective extensions.3154			 *3155			 * @since 3.0.03156			 *3157			 * @param array $mime_to_ext Array of image mime types and their matching extensions.3158			 */3159			$mime_to_ext = apply_filters(3160				'getimagesize_mimes_to_exts',3161				array(3162					'image/jpeg'          => 'jpg',3163					'image/png'           => 'png',3164					'image/gif'           => 'gif',3165					'image/bmp'           => 'bmp',3166					'image/tiff'          => 'tif',3167					'image/webp'          => 'webp',3168					'image/avif'          => 'avif',3169 3170					/*3171					 * In theory there are/should be file extensions that correspond to the3172					 * mime types: .heif, .heics and .heifs. However it seems that HEIC images3173					 * with any of the mime types commonly have a .heic file extension.3174					 * Seems keeping the status quo here is best for compatibility.3175					 */3176					'image/heic'          => 'heic',3177					'image/heif'          => 'heic',3178					'image/heic-sequence' => 'heic',3179					'image/heif-sequence' => 'heic',3180				)3181			);3182 3183			// Replace whatever is after the last period in the filename with the correct extension.3184			if ( ! empty( $mime_to_ext[ $real_mime ] ) ) {3185				$filename_parts = explode( '.', $filename );3186 3187				array_pop( $filename_parts );3188				$filename_parts[] = $mime_to_ext[ $real_mime ];3189				$new_filename     = implode( '.', $filename_parts );3190 3191				if ( $new_filename !== $filename ) {3192					$proper_filename = $new_filename; // Mark that it changed.3193				}3194 3195				// Redefine the extension / MIME.3196				$wp_filetype = wp_check_filetype( $new_filename, $mimes );3197				$ext         = $wp_filetype['ext'];3198				$type        = $wp_filetype['type'];3199			} else {3200				// Reset $real_mime and try validating again.3201				$real_mime = false;3202			}3203		}

Changelog

Introduced in 3.0.0. Unchanged from 6.7.7 through 7.1.0.

1. 6.7.7
2. 6.8.8
3. 6.9.7
4. 7.0.4
5. 7.1.0

Signature, return type and hooks compared across 5 parsed releases.

About this page

Parsed data

Generated from the wordpress-develop 7.1.0 tag, from src/wp-includes/functions.php, and regenerated for each WordPress release so it tracks the code rather than a snapshot of it.

Corrections

Something wrong on this page? Report it and it gets fixed in the next regeneration.