I found two really good links talking about how to upload image file and validate file format in more secure way rather than just checking file extension. http://www.dotnetexpertguide.com/2011/05/validate-uploaded-image-content-in.html http://www.aaronstannard.com/post/2011/06/24/How-to-Securely-Verify-and-Validate-Image-Uploads-in-ASPNET-and-ASPNET-MVC.aspx You should also check image file