Printable Version of Topic

Click here to view this topic in its original format

HTMLHelp Forums _ Server-side Scripting _ file upload from a form

Posted by: jalguire Jul 14 2012, 08:17 PM

When using a form to upload a file via PHP, it appears that the browser user agent does some internal processing and only provides the actual file name, without the full path name, to the PHP global $_FILE. I have looked at most all the PHP server-side globals and have not as yet found any mention of the path to the uploading file.

It seems to me that this information must be available somewhere to enable the browser, via the form, to upload the file to the server.

If anyone knows where this path information is hiding and how it might be accessed, I sure would appreciate knowing to find it.

Thanks, Jim

Posted by: Christian J Jul 15 2012, 07:05 AM

It should be kept hidden by the UA for security reasons.

Posted by: jalguire Jul 15 2012, 12:56 PM

QUOTE(Christian J @ Jul 15 2012, 04:05 AM)

It should be kept hidden by the UA for security reasons.

Christian, thanks for the reply. Apparently not all UAs are concerned with security. Safari and Chrome both conceal the path to the file, but Firefox and Opera display it in a text box for all to see. This on the Mac.

Jim

Posted by: Christian J Jul 15 2012, 02:08 PM

True, but it isn't sent along with the form submission. Javascript shouldn't be able to access the file text field's content either.

Posted by: jalguire Jul 15 2012, 07:54 PM

QUOTE(Christian J @ Jul 15 2012, 11:08 AM)

True, but it isn't sent along with the form submission. Javascript shouldn't be able to access the file text field's content either.

Thanks again. That is what I found too, but nice to have a confirmation.
Jim