php - When remote downloading a file, what is the earliest point at which I can verify whether it's malicious or not? -

when downloading file remotely, safe download file, , then check whether it's valid file, or late once it's on webserver?

i'm creating script download images remotely, right perform following steps

• verify valid url submitted
• check if last 3 characters of url allowed extension
• get headers of file, , check if content-length within size limits
• downloading file string using file_get_contents() (with content-length value specified length parameter (which should stop people submitting huge files incorrect content-length)
• inputting string createimagefromstring() , making sure returns true
• writing file

is there wrong doing this? need check else before downloading file string?