Hi all,

I've got the upload control doing validation of the mime type, but there's a problem with it.

If I rename an EXE to XLS, the upload control thinks it's an Excel file and goes on its merry way.

Is there a way to inspect the CONTENTS of the file (maybe just the file header) and validate that the actual file is what it is and not what the extension says it is? I'm using C# in the back end but am open to whatever works

And just so I understand, if the user DOES change the extension from EXE to XLS, is there any harm in still uploading the file? And what would happen if I tried to open that file (formerly EXE now XLS) when it was served up from my application?

Thanks,
Jon