Uploading Files with ASP

Getting Started

Before we begin, create a new folder called 'uploaddemo' in your C:\inetpub\wwwroot directory (or where-ever else your files are stored for IIS). Create a new file in there called upload.asp, and another called uploadcomplete.asp. Leave these files empty for now.

Now, create another directory within 'uploaddemo' called 'files'. This is where our uploaded files are going to be stored. In order for this to work, you need to allow IIS to be given write access to this directory. To do this, go to the Internet Information Services console, select the appropriate web, and then display the properties for the 'files' directory. In the Directory tab, ensure the 'Write' checkbox is selected, and click OK.

We're now ready to write some code for upload.asp, where the user will be presented with a form to select a file, and give the file a description. Add the following code to the upload.asp file, and then we'll take a closer look at it.

<html>
<head>
<title>VB Web ASP File Upload</title>
</head>
<body>
<form action="uploadcomplete.asp" method="POST" enctype="multipart/form-data">
 <p>Please select a file to upload, and enter a description for it.</p>
 <p><b>File: </b><input type="file" style="width: 300;" name="thefile"><br>
 <b>Description:</b><br><textarea name="description" rows=4 cols=30></textarea></p>
 <input type="submit" value="Upload">
</form>
</body>
</html>

As you can see, the form is currently just plain HTML. However, there are a few differences that you may not have come across before. The first is this:

<form action="uploadcomplete.asp" method="POST" enctype="multipart/form-data">

Although at first glance this is a standard form, the enctype property makes a significant difference! When set to multipart/form-data, the form is not posted in the standard format - you will not be able to access the posted data through the standard Request.Form(FieldName) syntax. However, this format does allow files to be transmitted to the server, as well as form fields. When we create our ActiveX DLL, it will parse this posted data, and save the appropriate part into a new file.

The second difference is the

<input type="file" style="width: 300;" name="thefile">

line, which uses the "file" input type. This input field allows the user to select a file using an Open dialog.

The 'File' input type
When a form is submitted using this input box, the file, rather than the filename is transmitted. However, this does have some security consequences... A website could in theory hide this field, with it's value pre-set, and then when the user transmits the form, he/she unknowingly sends the server a file too. Therefore, both IE and Netscape have disabled the value property for this type of input field. The consequence of this, is if you use server-side validation (for, say, checking the length of the description), when you display the form again with the error, you won't be able to use the input tag's value attribute to remember the file the user already selected. Something to bear in mind....

You might also like...

Comments

About the author

James Crowley

James Crowley United Kingdom

James first started this website when learning Visual Basic back in 1999 whilst studying his GCSEs. The site grew steadily over the years while being run as a hobby - to a regular monthly audien...

Interested in writing for us? Find out more.

Contribute

Why not write for us? Or you could submit an event or a user group in your area. Alternatively just tell us what you think!

Our tools

We've got automatic conversion tools to convert C# to VB.NET, VB.NET to C#. Also you can compress javascript and compress css and generate sql connection strings.

“You can stand on the shoulders of giants OR a big enough pile of dwarfs, works either way.”