Well, I know that I can't check if it's an image of not at client side , but not all users think to change file extension ,  but we can use that solution as indicator to the user that we accept images only, and at server side we can use your "sure fire" way to detect images inly, anyway Great Topic , thank you very much.

mcmcomasp

while this solution is still workable the problem still exists where a user can easily change the extension of the filename to bypass this check.  the only "sure fire" way to know if its an image is to peek at the file stream as i demonstrated above.

hth,

mcm