How to Use PHP's md5_file() Function with a Virus Database to Detect Malicious Files?

M66 2025-06-23

In daily web development or server management, it is sometimes necessary to ensure that the files uploaded by users are free from viruses or malicious content. Although PHP itself is not an antivirus tool, by combining the md5_file() function with a virus signature database, a simple virus detection mechanism can be implemented. This article will explain how to use PHP's md5_file() function along with a virus database to check if a file is a known virus.

What is md5_file()?

PHP's md5_file() function computes the MD5 hash value of a file. This hash value serves as a digital fingerprint of the file's content, meaning if the content of the file changes, its MD5 value will change as well. By comparing the MD5 value with known virus MD5 values in the virus database, we can determine whether a file is a known virus.

$md5 = md5_file('upload/test.exe');
echo "The MD5 value of this file is: " . $md5;

Preparing the Virus Database

A virus database is a list that contains MD5 values of known virus files. You can obtain such databases from open-source communities or security organizations, such as m66.net/virusdb.txt. Alternatively, you can maintain your own virus database as needed.

The virus database is usually formatted with one MD5 value per line, like this:

5f4dcc3b5aa765d61d8327deb882cf99
e99a18c428cb38d5f260853678922e03
098f6bcd4621d373cade4e832627b4f6

Implementing Virus Detection Functionality

Below is a complete PHP example for detecting whether an uploaded file is a virus:

function isVirus($filePath, $virusDbPath = 'http://m66.net/virusdb.txt') {
    if (!file_exists($filePath)) {
        return false;
    }

// Fetch virus database content
$virusDb = file($virusDbPath, FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES);

if ($virusDb === false) {
    die("Unable to load the virus database!");
}

// Compare MD5 value with the database
return in_array($fileMd5, $virusDb);

}

// Example usage
$uploadFile = 'upload/test.exe';

if (isVirus($uploadFile)) {
echo "Warning: This file might be a virus!";
} else {
echo "File is safe.";
}

Important Considerations

Virus Database Updates: To ensure effective detection, the virus database should be updated regularly.
File Size Limitations: The md5_file() function reads the entire file, which may consume more memory when dealing with large files.
Only Detects Known Viruses: This method cannot detect unknown viruses or variants. It is recommended to use it alongside professional antivirus software or APIs.
Remote Reading: If the virus database is hosted on a remote server (like m66.net), ensure the server is stable and handle errors properly.

Conclusion

By combining PHP's md5_file() function with a virus database, we can quickly implement a basic file virus detection feature. While this method cannot replace professional antivirus software, it is useful for preliminary screening and ensuring the security of uploaded files. In higher-security environments, it is advisable to integrate more specialized security detection services.

md5_file