FileUpload Class
 
System_CAPS_noteNote

The .NET API Reference documentation has a new home. Visit the .NET API Browser on docs.microsoft.com to see the new experience.

Displays a text box control and a browse button that enable users to select a file to upload to the server.

Namespace:   System.Web.UI.WebControls
Assembly:  System.Web (in System.Web.dll)

SystemObject
   System.Web.UIControl
     System.Web.UI.WebControlsWebControl
      System.Web.UI.WebControlsFileUpload

[ControlValuePropertyAttribute("FileBytes")]
[ValidationPropertyAttribute("FileName")]
public class FileUpload : WebControl
[ControlValuePropertyAttribute("FileBytes")]
[ValidationPropertyAttribute("FileName")]
public ref class FileUpload : WebControl
[<ControlValuePropertyAttribute("FileBytes")>]
[<ValidationPropertyAttribute("FileName")>]
type FileUpload = 
    class
        inherit WebControl
    end
<ControlValuePropertyAttribute("FileBytes")>
<ValidationPropertyAttribute("FileName")>
Public Class FileUpload
	Inherits WebControl
NameDescription
System_CAPS_pubmethod FileUpload

Initializes a new instance of the FileUpload class.

NameDescription
System_CAPS_pubproperty

Gets or sets the access key that allows you to quickly navigate to the Web server control.(Inherited from WebControl.)

System_CAPS_protproperty

Gets the browser-specific adapter for the control.(Inherited from Control.)

System_CAPS_pubproperty

Gets or sets a value that specifies whether multiple files can be selected for upload.

System_CAPS_pubproperty

Gets or sets the application-relative virtual directory of the Page or UserControl object that contains this control.(Inherited from Control.)

System_CAPS_pubproperty

Gets the collection of arbitrary attributes (for rendering only) that do not correspond to properties on the control.(Inherited from WebControl.)

System_CAPS_pubproperty

Gets or sets the background color of the Web server control.(Inherited from WebControl.)

System_CAPS_pubproperty

This API supports the product infrastructure and is not intended to be used directly from your code. Gets the control that contains this control's data binding.(Inherited from Control.)

System_CAPS_pubproperty

Gets or sets the border color of the Web control.(Inherited from WebControl.)

System_CAPS_pubproperty

Gets or sets the border style of the Web server control.(Inherited from WebControl.)

System_CAPS_pubproperty

Gets or sets the border width of the Web server control.(Inherited from WebControl.)

System_CAPS_protproperty

Gets a value that indicates whether the server control's child controls have been created.(Inherited from Control.)

System_CAPS_pubproperty

Gets the control ID for HTML markup that is generated by ASP.NET.(Inherited from Control.)

System_CAPS_pubproperty

Gets or sets the algorithm that is used to generate the value of the property.(Inherited from Control.)

System_CAPS_protproperty

Gets a character value representing the separator character used in the property.(Inherited from Control.)

System_CAPS_protproperty

Gets the HttpContext object associated with the server control for the current Web request.(Inherited from Control.)

System_CAPS_pubproperty

Gets a ControlCollection object that represents the child controls for a specified server control in the UI hierarchy.(Inherited from Control.)

System_CAPS_pubproperty

Gets the style of the Web server control. This property is used primarily by control developers.(Inherited from WebControl.)

System_CAPS_pubproperty

Gets a value indicating whether a Style object has been created for the property. This property is primarily used by control developers.(Inherited from WebControl.)

System_CAPS_pubproperty

Gets or sets the Cascading Style Sheet (CSS) class rendered by the Web server control on the client.(Inherited from WebControl.)

System_CAPS_pubproperty

Gets a reference to the naming container if the naming container implements IDataItemContainer.(Inherited from Control.)

System_CAPS_pubproperty

Gets a reference to the naming container if the naming container implements IDataKeysControl.(Inherited from Control.)

System_CAPS_protproperty

Gets a value indicating whether a control is being used on a design surface.(Inherited from Control.)

System_CAPS_pubproperty

Gets or sets a value indicating whether the Web server control is enabled.(Inherited from WebControl.)

System_CAPS_pubproperty

Gets or sets a value indicating whether themes apply to this control.(Inherited from WebControl.)

System_CAPS_pubproperty

Gets or sets a value indicating whether the server control persists its view state, and the view state of any child controls it contains, to the requesting client.(Inherited from Control.)

System_CAPS_protproperty

Gets a list of event handler delegates for the control. This property is read-only.(Inherited from Control.)

System_CAPS_pubproperty

Gets an array of the bytes in a file that is specified by using a FileUpload control.

System_CAPS_pubproperty

Gets a Stream object that points to a file to upload using the FileUpload control.

System_CAPS_pubproperty

Gets the name of a file on a client to upload using the FileUpload control.

System_CAPS_pubproperty

Gets the font properties associated with the Web server control.(Inherited from WebControl.)

System_CAPS_pubproperty

Gets or sets the foreground color (typically the color of the text) of the Web server control.(Inherited from WebControl.)

System_CAPS_pubproperty

Gets a value indicating whether the control has attributes set.(Inherited from WebControl.)

System_CAPS_protproperty

Gets a value indicating whether the current server control's child controls have any saved view-state settings.(Inherited from Control.)

System_CAPS_pubproperty

Gets a value indicating whether the FileUpload control contains a file.

System_CAPS_pubproperty

Gets a value that indicates whether any files have been uploaded.

System_CAPS_pubproperty

Gets or sets the height of the Web server control.(Inherited from WebControl.)

System_CAPS_pubproperty

Gets or sets the programmatic identifier assigned to the server control.(Inherited from Control.)

System_CAPS_protproperty

This API supports the product infrastructure and is not intended to be used directly from your code. Gets the character used to separate control identifiers.(Inherited from Control.)

System_CAPS_protproperty

Gets a value indicating whether controls contained within this control have control state.(Inherited from Control.)

System_CAPS_protproperty

Gets a value indicating whether the control is enabled.(Inherited from WebControl.)

System_CAPS_protproperty

Gets a value that indicates whether the server control is saving changes to its view state.(Inherited from Control.)

System_CAPS_protproperty

Gets a value indicating whether view state is enabled for this control.(Inherited from Control.)

System_CAPS_protproperty

Gets a value indicating whether the control participates in loading its view state by instead of index. (Inherited from Control.)

System_CAPS_pubproperty

Gets a reference to the server control's naming container, which creates a unique namespace for differentiating between server controls with the same property value.(Inherited from Control.)

System_CAPS_pubproperty

Gets a reference to the Page instance that contains the server control.(Inherited from Control.)

System_CAPS_pubproperty

Gets a reference to the server control's parent control in the page control hierarchy.(Inherited from Control.)

System_CAPS_pubproperty

Gets the underlying HttpPostedFile object for a file that is uploaded by using the FileUpload control.

System_CAPS_pubproperty

Gets the collection of uploaded files.

System_CAPS_pubproperty

Gets a value that specifies the ASP.NET version that rendered HTML will be compatible with.(Inherited from Control.)

System_CAPS_pubproperty

Gets information about the container that hosts the current control when rendered on a design surface.(Inherited from Control.)

System_CAPS_pubproperty

Gets or sets the skin to apply to the control.(Inherited from WebControl.)

System_CAPS_pubproperty

Gets a collection of text attributes that will be rendered as a style attribute on the outer tag of the Web server control.(Inherited from WebControl.)

System_CAPS_pubproperty

Gets a value that indicates whether the control should set the disabled attribute of the rendered HTML element to "disabled" when the control's property is false.(Inherited from WebControl.)

System_CAPS_pubproperty

Gets or sets the tab index of the Web server control.(Inherited from WebControl.)

System_CAPS_protproperty

Gets the HtmlTextWriterTag value that corresponds to this Web server control. This property is used primarily by control developers.(Inherited from WebControl.)

System_CAPS_protproperty

Gets the name of the control tag. This property is used primarily by control developers.(Inherited from WebControl.)

System_CAPS_pubproperty

Gets or sets a reference to the template that contains this control. (Inherited from Control.)

System_CAPS_pubproperty

Gets the virtual directory of the Page or UserControl that contains the current server control.(Inherited from Control.)

System_CAPS_pubproperty

Gets or sets the text displayed when the mouse pointer hovers over the Web server control.(Inherited from WebControl.)

System_CAPS_pubproperty

Gets the unique, hierarchically qualified identifier for the server control.(Inherited from Control.)

System_CAPS_pubproperty

Gets or sets a value that indicates whether the control checks client input from the browser for potentially dangerous values.(Inherited from Control.)

System_CAPS_protproperty

Gets a dictionary of state information that allows you to save and restore the view state of a server control across multiple requests for the same page.(Inherited from Control.)

System_CAPS_protproperty

Gets a value that indicates whether the StateBag object is case-insensitive.(Inherited from Control.)

System_CAPS_pubproperty

Gets or sets the view-state mode of this control.(Inherited from Control.)

System_CAPS_pubproperty

Gets or sets a value that indicates whether a server control is rendered as UI on the page.(Inherited from Control.)

System_CAPS_pubproperty

Gets or sets the width of the Web server control.(Inherited from WebControl.)

NameDescription
System_CAPS_protmethod AddAttributesToRender

Adds the HTML attributes and styles of a FileUpload control to render to the specified System.Web.UIHtmlTextWriter object.(Overrides WebControlAddAttributesToRender.)

System_CAPS_protmethod AddedControl

Called after a child control is added to the collection of the Control object.(Inherited from Control.)

System_CAPS_protmethod AddParsedSubObject

Notifies the server control that an element, either XML or HTML, was parsed, and adds the element to the server control's ControlCollection object.(Inherited from Control.)

System_CAPS_pubmethod ApplyStyle

Copies any nonblank elements of the specified style to the Web control, overwriting any existing style elements of the control. This method is primarily used by control developers.(Inherited from WebControl.)

System_CAPS_pubmethod ApplyStyleSheetSkin

Applies the style properties defined in the page style sheet to the control.(Inherited from Control.)

System_CAPS_protmethod BeginRenderTracing

Begins design-time tracing of rendering data.(Inherited from Control.)

System_CAPS_protmethod BuildProfileTree

This API supports the product infrastructure and is not intended to be used directly from your code. Gathers information about the server control and delivers it to the property to be displayed when tracing is enabled for the page.(Inherited from Control.)

System_CAPS_protmethod ClearCachedClientID

This API supports the product infrastructure and is not intended to be used directly from your code. Sets the cached value to null.(Inherited from Control.)

System_CAPS_protmethod ClearChildControlState

Deletes the control-state information for the server control's child controls. (Inherited from Control.)

System_CAPS_protmethod ClearChildState

Deletes the view-state and control-state information for all the server control's child controls.(Inherited from Control.)

System_CAPS_protmethod ClearChildViewState

Deletes the view-state information for all the server control's child controls.(Inherited from Control.)

System_CAPS_protmethod ClearEffectiveClientIDMode

This API supports the product infrastructure and is not intended to be used directly from your code. Sets the property of the current control instance and of any child controls to Inherit.(Inherited from Control.)

System_CAPS_pubmethod CopyBaseAttributes

Copies the properties not encapsulated by the object from the specified Web server control to the Web server control that this method is called from. This method is used primarily by control developers.(Inherited from WebControl.)

System_CAPS_protmethod CreateChildControls

Called by the ASP.NET page framework to notify server controls that use composition-based implementation to create any child controls they contain in preparation for posting back or rendering.(Inherited from Control.)

System_CAPS_protmethod CreateControlCollection

Creates a new ControlCollection object to hold the child controls (both literal and server) of the server control.(Inherited from Control.)

System_CAPS_protmethod CreateControlStyle

Creates the style object that is used internally by the WebControl class to implement all style related properties. This method is used primarily by control developers.(Inherited from WebControl.)

System_CAPS_pubmethod DataBind

Binds a data source to the invoked server control and all its child controls.(Inherited from Control.)

System_CAPS_protmethod DataBind

Binds a data source to the invoked server control and all its child controls with an option to raise the DataBinding event. (Inherited from Control.)

System_CAPS_protmethod DataBindChildren

Binds a data source to the server control's child controls.(Inherited from Control.)

System_CAPS_pubmethod Dispose

Enables a server control to perform final clean up before it is released from memory.(Inherited from Control.)

System_CAPS_protmethod EndRenderTracing

Ends design-time tracing of rendering data.(Inherited from Control.)

System_CAPS_protmethod EnsureChildControls

Determines whether the server control contains child controls. If it does not, it creates child controls.(Inherited from Control.)

System_CAPS_protmethod EnsureID

Creates an identifier for controls that do not have an identifier assigned.(Inherited from Control.)

System_CAPS_pubmethod Equals

Determines whether the specified object is equal to the current object.(Inherited from Object.)

System_CAPS_protmethod Finalize

Allows an object to try to free resources and perform other cleanup operations before it is reclaimed by garbage collection.(Inherited from Object.)

System_CAPS_pubmethod FindControl

Searches the current naming container for a server control with the specified id parameter.(Inherited from Control.)

System_CAPS_protmethod FindControl

This API supports the product infrastructure and is not intended to be used directly from your code. Searches the current naming container for a server control with the specified id and an integer, specified in the pathOffset parameter, which aids in the search. You should not override this version of the FindControl method.(Inherited from Control.)

System_CAPS_pubmethod Focus

Sets input focus to a control.(Inherited from Control.)

System_CAPS_protmethod GetDesignModeState

This API supports the product infrastructure and is not intended to be used directly from your code. Gets design-time data for a control.(Inherited from Control.)

System_CAPS_pubmethod GetHashCode

Serves as the default hash function. (Inherited from Object.)

System_CAPS_pubmethod GetRouteUrl

Gets the URL that corresponds to a set of route parameters.(Inherited from Control.)

System_CAPS_pubmethod GetRouteUrl

Gets the URL that corresponds to a set of route parameters.(Inherited from Control.)

System_CAPS_pubmethod GetRouteUrl

Gets the URL that corresponds to a set of route parameters and a route name.(Inherited from Control.)

System_CAPS_pubmethod GetRouteUrl

Gets the URL that corresponds to a set of route parameters and a route name.(Inherited from Control.)

System_CAPS_pubmethod GetType

Gets the Type of the current instance.(Inherited from Object.)

System_CAPS_pubmethod GetUniqueIDRelativeTo

Returns the prefixed portion of the property of the specified control.(Inherited from Control.)

System_CAPS_pubmethod HasControls

Determines if the server control contains any child controls.(Inherited from Control.)

System_CAPS_protmethod HasEvents

Returns a value indicating whether events are registered for the control or any child controls.(Inherited from Control.)

System_CAPS_protmethod IsLiteralContent

This API supports the product infrastructure and is not intended to be used directly from your code. Determines if the server control holds only literal content.(Inherited from Control.)

System_CAPS_protmethod LoadControlState

Restores control-state information from a previous page request that was saved by the SaveControlState method.(Inherited from Control.)

System_CAPS_protmethod LoadViewState

Restores view-state information from a previous request that was saved with the SaveViewState method. (Inherited from WebControl.)

System_CAPS_protmethod MapPathSecure

Retrieves the physical path that a virtual path, either absolute or relative, maps to.(Inherited from Control.)

System_CAPS_protmethod MemberwiseClone

Creates a shallow copy of the current Object.(Inherited from Object.)

System_CAPS_pubmethod MergeStyle

Copies any nonblank elements of the specified style to the Web control, but will not overwrite any existing style elements of the control. This method is used primarily by control developers.(Inherited from WebControl.)

System_CAPS_protmethod OnBubbleEvent

Determines whether the event for the server control is passed up the page's UI server control hierarchy.(Inherited from Control.)

System_CAPS_protmethod OnDataBinding

Raises the DataBinding event.(Inherited from Control.)

System_CAPS_protmethod OnInit

Raises the Init event.(Inherited from Control.)

System_CAPS_protmethod OnLoad

Raises the Load event.(Inherited from Control.)

System_CAPS_protmethod OnPreRender

Raises the PreRender event for the FileUpload control.(Overrides ControlOnPreRender.)

System_CAPS_protmethod OnUnload

Raises the Unload event.(Inherited from Control.)

System_CAPS_protmethod OpenFile

Gets a Stream used to read a file.(Inherited from Control.)

System_CAPS_protmethod RaiseBubbleEvent

Assigns any sources of the event and its information to the control's parent.(Inherited from Control.)

System_CAPS_protmethod RemovedControl

Called after a child control is removed from the collection of the Control object.(Inherited from Control.)

System_CAPS_protmethod Render

Sends the FileUpload control content to the specified System.Web.UIHtmlTextWriter object, which writes the content to render on the client.(Overrides WebControlRender.)

System_CAPS_pubmethod RenderBeginTag

Renders the HTML opening tag of the control to the specified writer. This method is used primarily by control developers.(Inherited from WebControl.)

System_CAPS_protmethod RenderChildren

Outputs the content of a server control's children to a provided HtmlTextWriter object, which writes the content to be rendered on the client.(Inherited from Control.)

System_CAPS_protmethod RenderContents

Renders the contents of the control to the specified writer. This method is used primarily by control developers.(Inherited from WebControl.)

System_CAPS_pubmethod RenderControl

Outputs server control content to a provided HtmlTextWriter object and stores tracing information about the control if tracing is enabled.(Inherited from Control.)

System_CAPS_protmethod RenderControl

Outputs server control content to a provided HtmlTextWriter object using a provided ControlAdapter object.(Inherited from Control.)

System_CAPS_pubmethod RenderEndTag

Renders the HTML closing tag of the control into the specified writer. This method is used primarily by control developers.(Inherited from WebControl.)

System_CAPS_protmethod ResolveAdapter

Gets the control adapter responsible for rendering the specified control.(Inherited from Control.)

System_CAPS_pubmethod ResolveClientUrl

Gets a URL that can be used by the browser.(Inherited from Control.)

System_CAPS_pubmethod ResolveUrl

Converts a URL into one that is usable on the requesting client.(Inherited from Control.)

System_CAPS_pubmethod SaveAs

Saves the contents of an uploaded file to a specified path on the Web server.

System_CAPS_protmethod SaveControlState

Saves any server control state changes that have occurred since the time the page was posted back to the server.(Inherited from Control.)

System_CAPS_protmethod SaveViewState

Saves any state that was modified after the TrackViewState method was invoked.(Inherited from WebControl.)

System_CAPS_protmethod SetDesignModeState

Sets design-time data for a control.(Inherited from Control.)

System_CAPS_pubmethod SetRenderMethodDelegate

This API supports the product infrastructure and is not intended to be used directly from your code. Assigns an event handler delegate to render the server control and its content into its parent control.(Inherited from Control.)

System_CAPS_pubmethod SetTraceData

Sets trace data for design-time tracing of rendering data, using the trace data key and the trace data value.(Inherited from Control.)

System_CAPS_pubmethod SetTraceData

Sets trace data for design-time tracing of rendering data, using the traced object, the trace data key, and the trace data value.(Inherited from Control.)

System_CAPS_pubmethod ToString

Returns a string that represents the current object.(Inherited from Object.)

System_CAPS_protmethod TrackViewState

Causes the control to track changes to its view state so they can be stored in the object's property.(Inherited from WebControl.)

NameDescription
System_CAPS_pubevent DataBinding

Occurs when the server control binds to a data source.(Inherited from Control.)

System_CAPS_pubevent Disposed

Occurs when a server control is released from memory, which is the last stage of the server control lifecycle when an ASP.NET page is requested.(Inherited from Control.)

System_CAPS_pubevent Init

Occurs when the server control is initialized, which is the first step in its lifecycle.(Inherited from Control.)

System_CAPS_pubevent Load

Occurs when the server control is loaded into the Page object.(Inherited from Control.)

System_CAPS_pubevent PreRender

Occurs after the Control object is loaded but prior to rendering.(Inherited from Control.)

System_CAPS_pubevent Unload

Occurs when the server control is unloaded from memory.(Inherited from Control.)

NameDescription
System_CAPS_pubinterface System_CAPS_privmethod IAttributeAccessorGetAttribute

This API supports the product infrastructure and is not intended to be used directly from your code. Gets an attribute of the Web control with the specified name.(Inherited from WebControl.)

System_CAPS_pubinterface System_CAPS_privmethod IAttributeAccessorSetAttribute

Sets an attribute of the Web control to the specified name and value.(Inherited from WebControl.)

System_CAPS_pubinterface System_CAPS_privmethod IControlDesignerAccessorGetDesignModeState

For a description of this member, see IControlDesignerAccessorGetDesignModeState.(Inherited from Control.)

System_CAPS_pubinterface System_CAPS_privmethod IControlDesignerAccessorSetDesignModeState

For a description of this member, see IControlDesignerAccessorSetDesignModeState. (Inherited from Control.)

System_CAPS_pubinterface System_CAPS_privmethod IControlDesignerAccessorSetOwnerControl

This API supports the product infrastructure and is not intended to be used directly from your code. For a description of this member, see IControlDesignerAccessorSetOwnerControl. (Inherited from Control.)

System_CAPS_pubinterface System_CAPS_privmethod IParserAccessorAddParsedSubObject

For a description of this member, see IParserAccessorAddParsedSubObject. (Inherited from Control.)

System_CAPS_pubinterface System_CAPS_privproperty

For a description of this member, see . (Inherited from Control.)

System_CAPS_pubinterface System_CAPS_privproperty

For a description of this member, see . (Inherited from Control.)

System_CAPS_pubinterface System_CAPS_privproperty

For a description of this member, see . (Inherited from Control.)

System_CAPS_pubinterface System_CAPS_privproperty

For a description of this member, see . (Inherited from Control.)

System_CAPS_pubinterface System_CAPS_privproperty

For a description of this member, see . (Inherited from Control.)

System_CAPS_pubinterface System_CAPS_privproperty

For a description of this member, see . (Inherited from Control.)

NameDescription
System_CAPS_pubmethod FindDataSourceControl

Returns the data source that is associated with the data control for the specified control.(Defined by DynamicDataExtensions.)

System_CAPS_pubmethod FindFieldTemplate

Returns the field template for the specified column in the specified control's naming container.(Defined by DynamicDataExtensions.)

System_CAPS_pubmethod FindMetaTable

Returns the metatable object for the containing data control.(Defined by DynamicDataExtensions.)

In this topic:

  • Introduction

  • Saving Uploaded Files

  • Security Considerations

  • Memory Limitations

  • Using the FileUpload Control with the UpdatePanel Control

  • Declarative Syntax

The FileUpload class displays a text box control and a browse button that enable users to select a file on the client and upload it to the Web server. The user specifies the file to upload by entering the full path of the file on the local computer (for example, C:\MyFiles\TestFile.txt) in the text box of the control. Alternately, the user can select the file by clicking the Browse button, and then locating it in the Choose File dialog box.

Use the property to get the name of a file on a client to upload by using the FileUpload control. The file name that this property returns does not include the path of the file on the client.

The property gets a Stream object that points to a file to upload. Use this property to access the contents of the file as bytes. For example, you can use the Stream object that is returned by the property to read the contents of the file as bytes and store them in a byte array. Alternatively, you can use the property to retrieve all the bytes in the file.

The property gets the underlying HttpPostedFile object for the file to upload. You can use this property to access additional properties on the file. The property gets the length of the file. The property gets the MIME content type of the file. In addition, you can use the property to access the property, the property, and the SaveAs method. However, the same functionality is provided by the property, the property, and the SaveAs method.

The FileUpload control does not automatically save a file to the server after the user selects the file to upload. You must explicitly provide a control or mechanism to allow the user to submit the specified file. For example, you can provide a button that the user clicks to upload the file. The code that you write to save the specified file should call the SaveAs method, which saves the contents of a file to a specified path on the server. Typically, the SaveAs method is called in an event-handling method for an event that raises a post back to the server. For example, if you provide a button to submit a file, you could include the code to save the file inside the event-handling method for the click event.

Before calling the SaveAs method to save the file to the server, use the property to verify that the FileUpload control contains a file. If the returns true, call the SaveAs method. If it returns false, display a message to the user indicating that the control does not contain a file. Do not check the property to determine whether a file to upload exists because, by default, this property contains 0 bytes. As a result, even when the FileUpload control is blank, the property returns a non-null value.

When you call the SaveAs method, you must specify the full path of the directory in which to save the uploaded file. If you do not explicitly specify a path in your application code, an exception is thrown when a user attempts to upload a file. This behavior helps keep the files on the server secure by preventing users from being able to write to arbitrary locations in your application's directory structure, as well as preventing access to sensitive root directories.

The SaveAs method writes the uploaded file to the specified directory. Therefore, the ASP.NET application must have write access to the directory on the server. There are two ways that the application can get write access. You can explicitly grant write access to the account under which the application is running, in the directory in which the uploaded files will be saved. Alternatively, you can increase the level of trust that is granted to the ASP.NET application. To get write access to the executing directory for the application, the application must be granted the AspNetHostingPermission object with the trust level set to the AspNetHostingPermissionLevelMedium value. Increasing the level of trust increases the application's access to resources on the server. Note that this is not a secure approach, because a malicious user who gains control of your application will also be able to run under this higher level of trust. It is a best practice to run an ASP.NET application in the context of a user with the minimum privileges that are required for the application to run. For more information about security in ASP.NET applications, see Basic Security Practices for Web Applications and ASP.NET Trust Levels and Policy Files.

One way to guard against denial of service attacks is to limit the size of the files that can be uploaded by using the FileUpload control. You should set a size limit that is appropriate for the types of files that you expect to be uploaded. The default size limit is 4096 kilobytes (KB), or 4 megabytes (MB). You can allow larger files to be uploaded by setting the maxRequestLength attribute of the element. To increase the maximum allowable file size for the entire application, set the maxRequestLength attribute in the Web.config file. To increase the maximum allowable file size for a specified page, set the maxRequestLength attribute inside the location element in Web.config. For an example, see location Element (ASP.NET Settings Schema).

When uploading large files, a user might also receive the following error message:

aspnet_wp.exe (PID: 1520) was recycled because memory consumption exceeded 460 MB (60 percent of available RAM).

If your users encounter this error message, increase the value of the memoryLimit attribute in the of element the Web.config file for the application. The memoryLimit attribute specifies the maximum amount of memory that a worker process can use. If the worker process exceeds the memoryLimit amount, a new process is created to replace it, and all current requests are reassigned to the new process.

To control whether the file to upload is temporarily stored in memory or on the server while the request is being processed, set the requestLengthDiskThreshold attribute of the element. This attribute enables you to manage the size of the input stream buffer. The default is 256 bytes. The value that you specify should not exceed the value that you specify for the maxRequestLength attribute.

The FileUpload control is designed to be used only in postback scenarios and not in asynchronous postback scenarios during partial-page rendering. When you use a FileUpload control inside an UpdatePanel control, the file must be uploaded by using a control that is a PostBackTrigger object for the panel. UpdatePanel controls are used to update selected regions of a page instead of updating the whole page with a postback. For more information, see UpdatePanel Control Overview and Partial-Page Rendering Overview.

<asp:FileUpload
    AccessKey="string"
    BackColor="color name|#dddddd"
    BorderColor="color name|#dddddd"
    BorderStyle="NotSet|None|Dotted|Dashed|Solid|Double|Groove|Ridge|
        Inset|Outset"
    BorderWidth="size"
    CssClass="string"
    Enabled="True|False"
    EnableTheming="True|False"
    EnableViewState="True|False"
    Font-Bold="True|False"
    Font-Italic="True|False"
    Font-Names="string"
    Font-Overline="True|False"
    Font-Size="string|Smaller|Larger|XX-Small|X-Small|Small|Medium|
        Large|X-Large|XX-Large"
    Font-Strikeout="True|False"
    Font-Underline="True|False"
    ForeColor="color name|#dddddd"
    Height="size"
    ID="string"
    OnDataBinding="DataBinding event handler"
    OnDisposed="Disposed event handler"
    OnInit="Init event handler"
    OnLoad="Load event handler"
    OnPreRender="PreRender event handler"
    OnUnload="Unload event handler"
    runat="server"
    SkinID="string"
    Style="string"
    TabIndex="integer"
    ToolTip="string"
    Visible="True|False"
    Width="size"
/>

A Visual Studio Web site project with source code is available to accompany this topic: Download.

This section contains the following four examples:

  • The first example demonstrates how to create a FileUpload control that saves files to a path that is specified in code.

  • The second example demonstrates how to create a FileUpload control that saves files to a specified directory in the file system for the application.

  • The third example demonstrates how to create a FileUpload control that saves files to a specified path and limits the size of the file that can be uploaded.

  • The fourth example demonstrates how to create a FileUpload control that saves files to a specified path and allows only files that have the .doc or .xls file name extensions to be uploaded.

System_CAPS_cautionCaution

These examples demonstrate the basic syntax for the FileUpload control, but they do not demonstrate all the necessary error checking that should be completed before to saving the file. For a more complete example, see SaveAs.

The following example demonstrates how to create a FileUpload control that saves files to a path that is specified in code. The SaveAs method is called to save the file to the specified path on the server.

<%@ Page Language="C#" %>

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> 

<script runat="server">

  protected void UploadButton_Click(object sender, EventArgs e)
  {
    // Specify the path on the server to
    // save the uploaded file to.
    String savePath = @"c:\temp\uploads\";

    // Before attempting to perform operations
    // on the file, verify that the FileUpload 
    // control contains a file.
    if (FileUpload1.HasFile)
    {
      // Get the name of the file to upload.
      String fileName = FileUpload1.FileName;

      // Append the name of the file to upload to the path.
      savePath += fileName;


      // Call the SaveAs method to save the 
      // uploaded file to the specified path.
      // This example does not perform all
      // the necessary error checking.               
      // If a file with the same name
      // already exists in the specified path,  
      // the uploaded file overwrites it.
      FileUpload1.SaveAs(savePath);

      // Notify the user of the name of the file
      // was saved under.
      UploadStatusLabel.Text = "Your file was saved as " + fileName;
    }
    else
    {      
      // Notify the user that a file was not uploaded.
      UploadStatusLabel.Text = "You did not specify a file to upload.";
    }

  }
</script>

<html xmlns="http://www.w3.org/1999/xhtml" >
<head runat="server">
    <title>FileUpload Example</title>
</head>
<body>
    <form id="form1" runat="server">
    <div>
       <h4>Select a file to upload:</h4>

       <asp:FileUpload id="FileUpload1"                 
           runat="server">
       </asp:FileUpload>

       <br /><br />

       <asp:Button id="UploadButton" 
           Text="Upload file"
           OnClick="UploadButton_Click"
           runat="server">
       </asp:Button>    

       <hr />

       <asp:Label id="UploadStatusLabel"
           runat="server">
       </asp:Label>        
    </div>
    </form>
</body>
</html>
<%@ Page Language="VB" %>

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> 

<script runat="server">

  Sub UploadButton_Click(ByVal sender As Object, ByVal e As System.EventArgs)

    ' Specify the path on the server to
    ' save the uploaded file to.
    Dim savePath As String = "c:\temp\uploads\"

    ' Before attempting to perform operations
    ' on the file, verify that the FileUpload 
    ' control contains a file.
    If (FileUpload1.HasFile) Then
      ' Get the name of the file to upload.
      Dim fileName As String = FileUpload1.FileName

      ' Append the name of the file to upload to the path.
      savePath += fileName

      ' Call the SaveAs method to save the 
      ' uploaded file to the specified path.
      ' This example does not perform all
      ' the necessary error checking.               
      ' If a file with the same name
      ' already exists in the specified path,  
      ' the uploaded file overwrites it.
      FileUpload1.SaveAs(savePath)

      ' Notify the user of the name the file
      ' was saved under.
      UploadStatusLabel.Text = "Your file was saved as " & fileName

    Else
      ' Notify the user that a file was not uploaded.
      UploadStatusLabel.Text = "You did not specify a file to upload."
    End If

  End Sub

</script>

<html xmlns="http://www.w3.org/1999/xhtml" >
<head runat="server">
    <title>FileUpload Example</title>
</head>
<body>
    <form id="form1" runat="server">
    <div>
       <h4>Select a file to upload:</h4>

       <asp:FileUpload id="FileUpload1"                 
           runat="server">
       </asp:FileUpload>

       <br /><br />

       <asp:Button id="UploadButton" 
           Text="Upload file"
           OnClick="UploadButton_Click"
           runat="server">
       </asp:Button>    

       <hr />

       <asp:Label id="UploadStatusLabel"
           runat="server">
       </asp:Label>        
    </div>
    </form>
</body>
</html>

The following example demonstrates how to create a FileUpload control that saves files to a specified directory in the file system for the application. The property is used to get the physical file system path of the root directory for the currently executing server application. The SaveAs method is called to save the file to the specified path on the server.

<%@ Page Language="C#" %>

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<script runat="server">

    protected void UploadButton_Click(object sender, EventArgs e)
    {
        // Save the uploaded file to an "Uploads" directory
        // that already exists in the file system of the 
        // currently executing ASP.NET application.  
        // Creating an "Uploads" directory isolates uploaded 
        // files in a separate directory. This helps prevent
        // users from overwriting existing application files by
        // uploading files with names like "Web.config".
        string saveDir = @"\Uploads\";

        // Get the physical file system path for the currently
        // executing application.
        string appPath = Request.PhysicalApplicationPath;

        // Before attempting to save the file, verify
        // that the FileUpload control contains a file.
        if (FileUpload1.HasFile)
        {
            string savePath = appPath + saveDir +
                Server.HtmlEncode(FileUpload1.FileName);

            // Call the SaveAs method to save the 
            // uploaded file to the specified path.
            // This example does not perform all
            // the necessary error checking.               
            // If a file with the same name
            // already exists in the specified path,  
            // the uploaded file overwrites it.
            FileUpload1.SaveAs(savePath);

            // Notify the user that the file was uploaded successfully.
            UploadStatusLabel.Text = "Your file was uploaded successfully.";

        }
        else
        {
            // Notify the user that a file was not uploaded.
            UploadStatusLabel.Text = "You did not specify a file to upload.";   
        }
    }
</script>

<html xmlns="http://www.w3.org/1999/xhtml" >
<head runat="server">
    <title>FileUpload Class Example</title>
</head>
<body>
    <h3>FileUpload Class Example: Save To Application Directory</h3>
    <form id="form1" runat="server">
    <div>
       <h4>Select a file to upload:</h4>

       <asp:FileUpload id="FileUpload1"                 
           runat="server">
       </asp:FileUpload>

       <br/><br/>

       <asp:Button id="UploadButton" 
           Text="Upload file"
           OnClick="UploadButton_Click"
           runat="server">
       </asp:Button>    

       <hr />

       <asp:Label id="UploadStatusLabel"
           runat="server">
       </asp:Label>           
    </div>
    </form>
</body>
</html>
<%@ Page Language="VB" %>

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<script runat="server">
    Sub UploadButton_Click(ByVal sender As Object, ByVal e As System.EventArgs)

        ' Save the uploaded file to an "Uploads" directory
        ' that already exists in the file system of the 
        ' currently executing ASP.NET application.  
        ' Creating an "Uploads" directory isolates uploaded 
        ' files in a separate directory. This helps prevent
        ' users from overwriting existing application files by
        ' uploading files with names like "Web.config".
        Dim saveDir As String = "\Uploads\"

        ' Get the physical file system path for the currently
        ' executing application.
        Dim appPath As String = Request.PhysicalApplicationPath

        ' Before attempting to save the file, verify
        ' that the FileUpload control contains a file.
        If (FileUpload1.HasFile) Then
            Dim savePath As String = appPath + saveDir + _
                Server.HtmlEncode(FileUpload1.FileName)

            ' Call the SaveAs method to save the 
            ' uploaded file to the specified path.
            ' This example does not perform all
            ' the necessary error checking.               
            ' If a file with the same name
            ' already exists in the specified path,  
            ' the uploaded file overwrites it.
            FileUpload1.SaveAs(savePath)

            ' Notify the user that the file was uploaded successfully.
            UploadStatusLabel.Text = "Your file was uploaded successfully."

        Else
            ' Notify the user that a file was not uploaded.
            UploadStatusLabel.Text = "You did not specify a file to upload."
        End If

    End Sub

</script>

<html xmlns="http://www.w3.org/1999/xhtml" >
<head runat="server">
    <title>FileUpload Class Example</title>
</head>
<body>
   <h3>FileUpload Class Example: Save To Application Directory</h3>
   <form id="form1" runat="server">
   <div>   
       <h4>Select a file to upload:</h4>

       <asp:FileUpload id="FileUpload1"                 
           runat="server">
       </asp:FileUpload>

       <br/><br/>

       <asp:Button id="UploadButton" 
           Text="Upload file"
           OnClick="UploadButton_Click"
           runat="server">
       </asp:Button>    

       <hr />

       <asp:Label id="UploadStatusLabel"
           runat="server">
       </asp:Label>       

   </div>
   </form>
</body>
</html>

The following example demonstrates how to create a FileUpload control that saves files to a path that is specified in the code. The control limits the size of the file that can be uploaded to 5 MB. The property is used to access the underlying property and return the size of the file. If the size of the file to upload is less than 2 MB, the SaveAs method is called to save the file to the specified path on the server. In addition to checking for the maximum file size setting in your application code, you can set the maxRequestLength attribute of the element to a maximum allowable size in the configuration file for your application.

<%@ Page Language="C#" %>

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<script runat="server">

    protected void UploadButton_Click(object sender, EventArgs e)
    {
        // Specify the path on the server to
        // save the uploaded file to.
        string savePath = @"c:\temp\uploads\";

        // Before attempting to save the file, verify
        // that the FileUpload control contains a file.
        if (FileUpload1.HasFile)
        {                
            // Get the size in bytes of the file to upload.
            int fileSize = FileUpload1.PostedFile.ContentLength;

            // Allow only files less than 2,100,000 bytes (approximately 2 MB) to be uploaded.
            if (fileSize < 2100000)
            {

                // Append the name of the uploaded file to the path.
                savePath += Server.HtmlEncode(FileUpload1.FileName);

                // Call the SaveAs method to save the 
                // uploaded file to the specified path.
                // This example does not perform all
                // the necessary error checking.               
                // If a file with the same name
                // already exists in the specified path,  
                // the uploaded file overwrites it.
                FileUpload1.SaveAs(savePath);

                // Notify the user that the file was uploaded successfully.
                UploadStatusLabel.Text = "Your file was uploaded successfully.";
            }
            else
            {
                // Notify the user why their file was not uploaded.
                UploadStatusLabel.Text = "Your file was not uploaded because " + 
                                         "it exceeds the 2 MB size limit.";
            }
        }   
        else
        {
            // Notify the user that a file was not uploaded.
            UploadStatusLabel.Text = "You did not specify a file to upload.";
        }
    }
</script>

<html xmlns="http://www.w3.org/1999/xhtml" >
<head runat="server">
    <title>FileUpload Class Example</title>
</head>
<body>
    <form id="form1" runat="server">
    <div>
       <h4>Select a file to upload:</h4>

       <asp:FileUpload id="FileUpload1"                 
           runat="server">
       </asp:FileUpload>

       <br/><br/>

       <asp:Button id="UploadButton" 
           Text="Upload file"
           OnClick="UploadButton_Click"
           runat="server">
       </asp:Button>

       <hr />

       <asp:Label id="UploadStatusLabel"
           runat="server">
       </asp:Label>

    </div>
    </form>
</body>
</html>
<%@ Page Language="VB" %>

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<script runat="server">

    Protected Sub UploadButton_Click(ByVal sender As Object, ByVal e As System.EventArgs)

        ' Specify the path on the server to
        ' save the uploaded file to.
        Dim savePath As String = "c:\temp\uploads\"

        ' Before attempting to save the file, verify
        ' that the FileUpload control contains a file.
        If (FileUpload1.HasFile) Then

            ' Get the size in bytes of the file to upload.
            Dim fileSize As Integer = FileUpload1.PostedFile.ContentLength

            ' Allow only files less than 2,100,000 bytes (approximately 2 MB) to be uploaded.
            If (fileSize < 2100000) Then

                ' Append the name of the uploaded file to the path.
                savePath += Server.HtmlEncode(FileUpload1.FileName)

                ' Call the SaveAs method to save the 
                ' uploaded file to the specified path.
                ' This example does not perform all
                ' the necessary error checking.               
                ' If a file with the same name
                ' already exists in the specified path,  
                ' the uploaded file overwrites it.
                FileUpload1.SaveAs(savePath)

                ' Notify the user that the file was uploaded successfully.
                UploadStatusLabel.Text = "Your file was uploaded successfully."

            Else
                ' Notify the user why their file was not uploaded.
                UploadStatusLabel.Text = "Your file was not uploaded because " + _
                                         "it exceeds the 2 MB size limit."
            End If

        Else
            ' Notify the user that a file was not uploaded.
            UploadStatusLabel.Text = "You did not specify a file to upload."
        End If

    End Sub
</script>

<html xmlns="http://www.w3.org/1999/xhtml" >
<head runat="server">
    <title>FileUpload Class Example</title>
</head>
<body>
    <form id="form1" runat="server">
    <div>
       <h4>Select a file to upload:</h4>

       <asp:FileUpload id="FileUpload1"                 
           runat="server">
       </asp:FileUpload>

       <br/><br/>

       <asp:Button id="UploadButton" 
           Text="Upload file"
           OnClick="UploadButton_Click"
           runat="server">
       </asp:Button>

       <hr />

       <asp:Label id="UploadStatusLabel"
           runat="server">
       </asp:Label>

    </div>
    </form>
</body>
</html>

The following example demonstrates how to create a FileUpload control that saves files to a path that is specified in the code. This example allows only files that have the .doc or .xls file name extensions to be uploaded. The PathGetExtension method is called to return the extension of the file to upload. If the file has a .doc or .xls file name extension, the SaveAs method is called to save the file to the specified path on the server.

<%@ Page Language="C#" %>

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<script runat="server">

    protected void UploadBtn_Click(object sender, EventArgs e)
    {
        // Specify the path on the server to
        // save the uploaded file to.
        string savePath = @"c:\temp\uploads";

        // Before attempting to save the file, verify
        // that the FileUpload control contains a file.
        if (FileUpload1.HasFile)
        {
            // Get the name of the file to upload.
            string fileName = Server.HtmlEncode(FileUpload1.FileName);

            // Get the extension of the uploaded file.
            string extension = System.IO.Path.GetExtension(fileName);

            // Allow only files with .doc or .xls extensions
            // to be uploaded.
            if ((extension == ".doc") || (extension == ".xls"))
            {
                // Append the name of the file to upload to the path.
                savePath += fileName;

                // Call the SaveAs method to save the 
                // uploaded file to the specified path.
                // This example does not perform all
                // the necessary error checking.               
                // If a file with the same name
                // already exists in the specified path,  
                // the uploaded file overwrites it.
                FileUpload1.SaveAs(savePath);

                // Notify the user that their file was successfully uploaded.
                UploadStatusLabel.Text = "Your file was uploaded successfully.";
            }
            else
            {
                // Notify the user why their file was not uploaded.
                UploadStatusLabel.Text = "Your file was not uploaded because " + 
                                         "it does not have a .doc or .xls extension.";
            }

        }

    }

</script>

<html xmlns="http://www.w3.org/1999/xhtml" >
<head runat="server">
    <title>FileUpload Class Example</title>
</head>
<body>
    <form id="form1" runat="server">
    <div>
        <h4>Select a file to upload:</h4>

        <asp:FileUpload id="FileUpload1"                 
            runat="server">
        </asp:FileUpload>

        <br/><br/>

        <asp:Button id="UploadBtn" 
            Text="Upload file"
            OnClick="UploadBtn_Click"
            runat="server">
        </asp:Button>    

        <hr />

        <asp:Label id="UploadStatusLabel"
            runat="server">
        </asp:Label>     
    </div>
    </form>
</body>
</html>
<%@ Page Language="VB" %>

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<script runat="server">

    Protected Sub UploadBtn_Click(ByVal sender As Object, ByVal e As System.EventArgs)
        ' Specify the path on the server to
        ' save the uploaded file to.
        Dim savePath As String = "c:\temp\uploads\"

        ' Before attempting to save the file, verify
        ' that the FileUpload control contains a file.
        If (FileUpload1.HasFile) Then

            ' Get the name of the file to upload.
            Dim fileName As String = Server.HtmlEncode(FileUpload1.FileName)

            ' Get the extension of the uploaded file.
            Dim extension As String = System.IO.Path.GetExtension(fileName)

            ' Allow only files with .doc or .xls extensions
            ' to be uploaded.
            If (extension = ".doc") Or (extension = ".xls") Then

                ' Append the name of the file to upload to the path.
                savePath += fileName

                ' Call the SaveAs method to save the 
                ' uploaded file to the specified path.
                ' This example does not perform all
                ' the necessary error checking.               
                ' If a file with the same name
                ' already exists in the specified path,  
                ' the uploaded file overwrites it.
                FileUpload1.SaveAs(savePath)

                ' Notify the user that their file was successfully uploaded.
                UploadStatusLabel.Text = "Your file was uploaded successfully."

            Else
                ' Notify the user why their file was not uploaded.
                UploadStatusLabel.Text = "Your file was not uploaded because " + _
                                         "it does not have a .doc or .xls extension."
            End If

        Else
            ' Notify the user that a file was not uploaded.
            UploadStatusLabel.Text = "You did not specify a file to upload."
        End If
    End Sub
</script>

<html xmlns="http://www.w3.org/1999/xhtml" >
<head runat="server">
    <title>FileUpload Class Example</title>
</head>
<body>
    <form id="form1" runat="server">
    <div>
        <h4>Select a file to upload:</h4>

        <asp:FileUpload id="FileUpload1"                 
            runat="server">
        </asp:FileUpload>

        <br/><br/>

        <asp:Button id="UploadBtn" 
            Text="Upload file"
            OnClick="UploadBtn_Click"
            runat="server">
        </asp:Button>    

        <hr />

        <asp:Label id="UploadStatusLabel"
            runat="server">
        </asp:Label>     
    </div>
    </form>
</body>
</html>
.NET Framework
Available since 2.0

Any public static ( Shared in Visual Basic) members of this type are thread safe. Any instance members are not guaranteed to be thread safe.

Return to top