Yeah, you probably really want to be using a module to parse the MIME structure of the message, but you can probably still do some quick and dirty things.

You should search for Content-Type: headers. You can do something fancy or something crude. Something crude would be to catch it wherever it appears in the message, but this means you would catch it even if it appears as part of the text of the message (well, how likely is that??). You can get fancy and try to catch it only when it appears in MIME body part headers and not in bodies themselves, but the fancier you get the close you get to reinventing a preexisting MIME parser module such as the one you suggest -- so try to get one installed instead :-)

Once you are collecting Content-Type:s, you should whitelist the ones you will accept:

• message/*, because this forms part of the MIME structure and does not introduce a body part directly.
• multipart/*, same reason
• text/*, because these are generally the body parts that are not considered "attachments".

Anything else, like image/* and application/* is likely to be what should be considered an attachment.

Once you get a proper MIME parsing module installed and begin using it, you can use the same technique of whitelisting text/* but you won't have to worry about message/* and multipart/* because those will probably be dealt with by the module.

There is another header, called Content-Disposition: which specifies unambiguously whether a body part is inline or is an attachment, but you probably cannot use that because it is not always present.