Limit upload file types

Hi


I want to limit the allowed uploaded file types to images, pdfs, and docs.  What is the recommended way to approach this?
I assume checking the file extension alone is not enough, since an attacked can change the file extension as he wishes.
This is basically for a course management system for students to upload assignments and teachers to download and view them.


Thanks.
...