in reply to security issues for allowing images to be uploaded to the server

You can check the mime type associated with the uploaded file, before accepting it, i.e. moving it from its temporary location where it got uploaded, to its final destination.. It's the browser used for the upload that sets it, so I suppose that in general it is smart enough to recognize the platfrom-specific quirks. See the docs for CGI.pm to find out how to get at it:
When a file is uploaded the browser usually sends along some information along with it in the format of headers. The information usually includes the MIME content type. Future browsers may send other information as well (such as modification date and size). To retrieve this information, call uploadInfo().

Alternatively, when this is uploaded to a Unix-like system, you could use the file command line utility to check out what you got. It's really worth playing with a little.

  • Comment on Re: security issues for allowing images to be uploaded to the server