This page provides you with both a guide on how to use the upload ASP class and a reference of its methods and properties. The guide explains the roles that the "upload page", the "file uploaded" page, and the upload class play in sending a file. These files are contained in the ZIP available for download. In the particular case of our example, the "upload" and "file uploaded" pages are actually the same file: uploadTester.asp. The upload class is in freeASPUpload.asp.

We intend to document all aspects of this code with as much detail as possible, but in the end you will realize that the actual process of capturing and saving the uploaded files using Free ASP Upload is as simple as two short ASP lines.

Considerations about deployment

If you are adding an upload capability to your site (using this script or any other), you should consider who will have access to it, what files can be uploaded, and whether and how uploaded files are published on the site.

For example: it's a really bad idea if any visitor has access to the upload function and the files uploaded are automatically published on the site. If that is possible, then malicious visitors will quickly abuse your upload. More specifically, suppose you let anyone upload images to your web site directly, then your web site will soon be showing the wrong kind of images. Similarly, if you let users upload HTML pages to your site directly, then spammers will upload pages with links to their commercial sites.

There are three levels of prevention to avoid exploitation of your site's upload feature:

• The most obvious and effective way of avoiding the upload of spamming content is to not publish automatically the uploaded files. If you review each uploaded file before publishing it, or if you don't publish uploaded files at all (very common) the spammers will not even be interest in your site. The FreeASPUpload script let's you select a folder on the web server where to save the uploaded files. It is recommended to pick an internal folder (a folder that is not part of the published folders).

• If you really must allow anonymous upload of HTML pages and automatically publish them, then at least use robots.txt to block search engine spiders from that published directory.

• Another easy way to protect your site is to restrict access to the uploaded page. For example: if you have a personal site, and you are the only one supposed to use the upload feature, create a special page just for the upload, do not link to it from any other page, and don't share the URL with others. Alternatively you can simply protect that page with a password. If your site is the kind that asks for authentication from the users (username and password), that may also help keep the casual spammers out.

• Finally you can also to limit the kinds of files a user can upload. The types of file spammers will want to upload are .html, .htm, etc. Restricting the kinds of files are allowed to be uploaded requires some additonal ASP code, os it is not as easy as the first two strategies.

The first step to add upload capabilities to your site is to find a page to hold the upload form. Before creating your own, you should first try the one included in the ZIP file: the "uploadTester.asp" page. It illustrates all the necessary aspects of both the initial upload page and of the file-uploaded, landing page.

If you are creating your own uploading page, it must follow a few rules (see also section above about avoiding abuses from unauthorized visitors). This page does not have to be an ASP page, it can be plain HTML or any other file type that can render a form in the browser.

The uploading script is designed with support for international characters, and the upload page must account for that too. The charset of the page must be utf-8 (see the <META> element in "uploadTester.asp".)

The upload form is a FORM-element area that includes input elements of the kind "type=file". These elements — one for each file — let the user type the name of the file or browse in the system to pick it.

The folowing attributes of the FORM element are required and must have these exact values:

• method="POST"
• enctype="multipart/form-data"
• accept-charset="utf-8"

Besides the file elements and the submit button, the upload form may have elements of other types. This means that, together with file(s) to upload, you can also post other kinds of typical form data such as text, numbers, etc.

Finally, the ACTION parameter of the FORM tag will contain the address of the page that will process the upload and tell the user the file was uploaded. This is the page that includes the actual "Free ASP Upload" script, as described in the next section.

The "file-uploaded" page

This page will receive the information from the form, save the uploaded files, and process any other fields in your form. This needs to be an ASP page because it will #include the code of the FreeASPUpload class.

In some cases it is convenient to use the same file to render both the upload page and the "file-uploaded" one, like in our example. The ASP code in the file decides which page to render based on the value of Request.ServerVariables("REQUEST_METHOD").

When it comes to actually saving the uploaded files, it only takes two lines, one for the creation of the Free ASP Upload object and the other to extract the files from the POST request and save them to the server:

Set Upload = New FreeASPUpload
Upload.Save(upload directory path)

To process other fields in the form, use the Form collection of the upload object the same way you would use the Form collection of the Request object. For example, if your form had a text element named UserName, your processing code would include:

strUserName = Upload.Form("UserName")

If you want to control what file types the user can upload, you can do it with Javascript in a form validation function in the upload page or you can do it in the "file uploaded" page by checking the FileName property of each uploaded file. This server side solution requires the checking to be done after the files are actually uploaded (i.e.: after the Upload.Save statement.) When a file of the incorrect type is detected, you can remove the file from the server with a call to a FileSystemObject method.

If this page renders text entered in the upload form using the request.write ASP method, you must configure the ASP session to deal correctly with the UTF-8 unicode strings. You do this with the following ASP statement: Session.CodePage = 65001

FreeASPUpload quick Reference