File extensions are or may be at least. It is definitely better not to rely on / trusted user data. Also, as written in the PHP manual:
$_ FILES ['userfile'] ['type'] - mime , . "image/gif". mime, , PHP .
.
:
PHP getimagesize() , 2 IMAGETYPE_XXX ( , ), . GD, - image_type_to_extension() image_type_to_mime_type().
, - :
$imageData = getimagesize($_FILES['userfile']['tmp_name']);
$mimeType = image_type_to_mime_type($imageData[2]);
$extension = image_type_to_extension($imageData[2]);
, exif, [exif_imagetype()][5] , 2 getimagesize(), .
GD , PHP. Imagick , mime fileinfo ( 5.3, btw).