FileUpload control in ASP.NET

With ASP.NET, users have been able to accept file uploads very easy. With FileUpload control, this can be done with a few code lines, as you will see in the following example. However, please note that users take security concerns when accepting files! Markup is required at:

<form id="form1" runat="server">
    <asp:FileUpload id="FileUploadControl" runat="server" />
    <asp:Button runat="server" id="UploadButton" text="Upload" onclick="UploadButton_Click" />
    <br /><br />
    <asp:Label runat="server" id="StatusLabel" text="Upload status: " />
</form>

And here is the CodeBehind code required to handle the upload:

protected void UploadButton_Click(object sender, EventArgs e)
{
    if(FileUploadControl.HasFile)
    {
        try
        {
            string filename = Path.GetFileName(FileUploadControl.FileName);
            FileUploadControl.SaveAs(Server.MapPath("~/") + filename);
            StatusLabel.Text = "Upload status: File uploaded!";
        }
        catch(Exception ex)
        {
            StatusLabel.Text = "Upload status: The file could not be uploaded. The following error occured: " + ex.Message;
        }
    }
}

As you can see, all this is relatively simple. Once uploadButton is clicked, we check to see if an upload is specified in the upload control or not. If it is, then we use the FileUpload ControlSave method to save the file. We use the root of our project (we use the mappath method to obtain it) as well as the part of the name of the path that the user has specified if all goes well, then we will get the StatusLabel text Notify the user by setting the property - if not, an exception will be thrown, and we will also inform the user.

This example will get a job, but as you can see, nothing is examined. The user can upload any type of file, and the size of the file is limited only by server configuration. A more robust example might look like this:

protected void UploadButton_Click(object sender, EventArgs e)
{
    if(FileUploadControl.HasFile)
    {
        try
        {
            if(FileUploadControl.PostedFile.ContentType == "image/jpeg")
            {
                if(FileUploadControl.PostedFile.ContentLength < 102400)
                {
                    string filename = Path.GetFileName(FileUploadControl.FileName);
                    FileUploadControl.SaveAs(Server.MapPath("~/") + filename);
                    StatusLabel.Text = "Upload status: File uploaded!";
                }
                else
                    StatusLabel.Text = "Upload status: The file has to be less than 100 kb!";
            }
            else
                StatusLabel.Text = "Upload status: Only JPEG files are accepted!";
        }
        catch(Exception ex)
        {
            StatusLabel.Text = "Upload status: The file could not be uploaded. The following error occured: " + ex.Message;
        }
    }
}

Here we use two properties, content lamps and content type, which are trying to upload the user, to do some basic checks of the file. The position message should clearly indicate that all of them are about, and you can change them according to your needs.