Introduction

In PHP, the safest general answer is to use pathinfo(). It handles normal filenames, paths, and names with multiple dots more reliably than manual string splitting, and it makes your intention obvious to anyone reading the code.

Use pathinfo for Normal Cases

pathinfo() can return the whole breakdown of a path or just the extension portion.

1<?php
2$path = '/var/www/uploads/report.final.pdf';
3$extension = pathinfo($path, PATHINFO_EXTENSION);
4
5echo $extension . PHP_EOL;

That prints pdf.

If you want the full parsed structure, omit the second argument:

<?php
$info = pathinfo('/var/www/uploads/report.final.pdf');
print_r($info);

This returns pieces such as directory name, basename, filename, and extension.

Know What “Extension” Means

A filename does not always have an extension. README, .env, and archive are all valid names, but they do not behave like photo.jpg.

That means your code should expect an empty string when there is no extension:

1<?php
2$files = ['photo.jpg', 'README', '.env', 'archive.tar.gz'];
3
4foreach ($files as $file) {
5    $ext = pathinfo($file, PATHINFO_EXTENSION);
6    echo $file . ' => ' . ($ext === '' ? '[none]' : $ext) . PHP_EOL;
7}

Notice that archive.tar.gz returns gz. That is usually correct, but if your application treats tar.gz as a compound extension, you need custom logic for that rule.

Why explode Is Usually Inferior

A common beginner solution is explode('.', $filename) and then taking the last element. That works for simple names, but it is easy to get wrong around hidden files, paths, or filenames without dots.

For example:

<?php
$parts = explode('.', '.env');
var_dump(end($parts));

That returns env, which may look like an extension even though .env is usually just the whole filename. pathinfo() handles such cases more deliberately and reads better.

Extensions Are Not Security Validation

This matters in upload handling. A file ending in .jpg is not necessarily an image, and a malicious upload can be renamed easily. If you need to validate file type, inspect the content, not just the name.

PHP gives you finfo for MIME detection:

1<?php
2$finfo = new finfo(FILEINFO_MIME_TYPE);
3$mime = $finfo->file('example.pdf');
4
5echo $mime . PHP_EOL;

For uploads, a safer pattern is:

1. inspect the MIME type
2. compare it to an allowlist
3. generate your own stored filename
4. treat the original extension as display metadata, not proof of type

Normalize Case When Needed

File extensions are case-sensitive only by convention in many applications. If you compare extensions against an allowlist, normalize them first.

1<?php
2$ext = strtolower(pathinfo('PHOTO.JPEG', PATHINFO_EXTENSION));
3
4if (in_array($ext, ['jpg', 'jpeg', 'png'], true)) {
5    echo "allowed" . PHP_EOL;
6}

Without normalization, JPEG and jpeg may follow different paths in your code even though you intended them to mean the same thing.

Common Pitfalls

The biggest mistake is assuming every filename has an extension. Many do not, and hidden Unix-style files make the edge cases more obvious.

Another mistake is treating the extension as a trusted security signal. For uploads, always validate file content and store files safely.

A third mistake is ignoring compound formats such as tar.gz when your business logic cares about the full suffix rather than only the final segment.

Summary

• Use pathinfo($path, PATHINFO_EXTENSION) for normal PHP extension extraction.
• Expect empty results for names that do not really have an extension.
• 'explode('.') is fragile compared with pathinfo().'
• Normalize case before comparing extensions to an allowlist.
• For security-sensitive code such as uploads, validate file content with tools such as finfo, not just the extension.