I've made a Photo Gallery sort of site before, so I know the kind of problem you have. Unfortunately even MIME types cannot really be trusted (esp not from browser uploads either). The only proper solution is to consciously restrict your service to certain image formats (say GIF JPEG PNG; and probably also a maximum filesize) and then use a tool or module to verify the file as a valid GIF/JPEG/PNG after fetching it. (I have used Image::Magick for that before.)