The FileUpload class displays a text box control and a browse button that enable end users to select a file on the client and upload it to the Web server. The user specifies the file to upload by entering the full path of the file on the local computer (for example, C:\My Documents\MyTestFile.doc) in the text box of the control. Alternately, the end user can select the file by clicking the Browse button, and then locating it in the Choose File dialog box.
The FileUpload control does not automatically save a file to the server after the end user selects the file to upload. Web developer has to explicitly provide a control or mechanism to allow the end user to submit the specified file. The code that Web developer writes to save the specified file should call the SaveAs method, which saves the contents of a file to a specified path on the server. Typically, the SaveAs method is called in an event-handling method for an event that raises a post back to the server. Before calling the SaveAs method to save the file to the server, Web developer should use the HasFile property to verify that the FileUpload control contains a file. If the HasFile returns true, Web developer can call the SaveAs method. If it returns false, Web developer’s code should display a message to the end user indicating that the control does not contain a file. Web developer should not use the PostedFile property to determine whether a file to upload exists because, by default, this property contains 0 bytes. As a result, even when the FileUpload control is blank, the PostedFile property returns a non-null value.
When Web developer calls the SaveAs method, he/she must deterime the full path of the directory in which to save the uploaded file. If he/she does not explicitly specify a path in his/her application code, an exception is thrown when an end user attempts to upload a file. This behavior helps keep the files on the server secure by preventing end users from being able to write to arbitrary locations in directory structure and preventing access to sensitive root directories.
The SaveAs method writes the uploaded file to the specified directory. Therefore, the ASP.NET application must have write access to the directory on the server and there are two ways that the application can get write access:
– Web developer explicitly grants write access to the account under which the application is running, in the directory in which the uploaded files will be saved. To get write access to the executing directory for the application, the application must be granted the AspNetHostingPermission object with the trust level set to the AspNetHostingPermissionLevel.Medium value.
– Web developer increases the level of trust that is granted to the ASP.NET application which increases the application’s access to resources on the server. Note: This is not a secure approach, because a malicious user who gains control of the application will also be able to run under this higher level of trust. It is a best practice to run an ASP.NET application in the context of a user with the minimum privileges that are required for the application to run.
When Web developer uses this control, he/she should guard the application against denial of service attacks, by limiting the size of the files that can be uploaded by using the FileUpload control. He/she should set a size limit that is appropriate for the types of files that he/she expects to be uploaded. The default size limit is 4096 kilobytes (KB), or 4 megabytes (MB). Web developer can allow larger files to be uploaded by setting the maxRequestLength attribute of the httpRuntime element. To increase the maximum allowable file size for the entire application, he/she should set the maxRequestLength attribute in the Web.config file. To increase the maximum allowable file size for a specified page, he/she should set the maxRequestLength attribute inside the location element in Web.config.
When uploading large files, an end user might also receive the following error message:
aspnet_wp.exe (PID: 1520) was recycled because memory consumption exceeded 460 MB (60 percent of available RAM).
If end users encounter this error message, Web developer should increase the value of the memoryLimit attribute in the processModel element of the Web.config file for the application. The memoryLimit attribute specifies the maximum amount of memory that a worker process can use. If the worker process exceeds the memoryLimit amount, a new process is created to replace it, and all current requests are reassigned to the new process.
To control whether the file to upload is temporarily stored in memory or on the server while the request is being processed, Web developer should set the requestLengthDiskThreshold attribute of the httpRuntime element. This attribute enables to manage the size of the input stream buffer. The default is 256 bytes. The value that Web developer determines should not exceed the value that he/she specifies for the maxRequestLength attribute.
Namespace: System.Web.UI.WebControls
Assembly: System.Web (in System.Web.dll)
| Property | Description | Supported in .NET version |
| AccessKey | This property returns or sets the access key that allows software developer to quickly navigate to the Web server control. | 1.0,1.1, 2.0, 3.0, 3.5, 4.0 |
| Adapter | This property gets the browser-specific adapter for the control. | 2.0, 3.0, 3.5, 4.0 |
| AppRelativeTemplateSourceDirectory
|
Software developer can use this property to set or get the application-relative path to the page or user control that contains the current control. If the web page is installed in https://www.somesite.com/apps/application1 the property will return “~/application1”. | 2.0, 3.0, 3.5, 4.0 |
| Attributes | This property is a collection which contains a collection of all attributes declared in the opening tag of a Web server control. Software developer can control programmatically the attributes associated with a Web server control. He/she can add or remove attributes to/from the collection. | 1.0,1.1, 2.0, 3.0, 3.5, 4.0 |
| BackColor | The property is used to specify the background color of the Web server control. Software developer can set it using a System.Drawing..::.Color object. | 1.0,1.1, 2.0, 3.0, 3.5, 4.0 |
| BindingContainer | Software developer can’t use this property directly from his/her code, because it supports the .NET Framework infrastructure. The property contains a reference to the Control object which contains data-binding information for the current control. | 1.0,1.1, 2.0, 3.0, 3.5, 4.0 |
| BorderColor | The property is used to specify the border color of the Web server control. Software developer can set it using a System.Drawing..::.Color object. | 1.0,1.1, 2.0, 3.0, 3.5, 4.0 |
| BorderStyle | Specifies the type of the control’s border. Software developer can choose one of the values from the BorderStyle enumeration – Dashed, Dotted, Double, Grrove, Ridge, Inset, Outset, Solid and None. | 1.0,1.1, 2.0, 3.0, 3.5, 4.0 |
| BorderWidth | Specifies the size of the control’s border. When software developer sets this property he/she should use combination of a numeric value followed by type of measurement: px (for pixels) or % (for percentage) and so on. | 1.0,1.1, 2.0, 3.0, 3.5, 4.0 |
| ChildControlsCreated | Gets a true value that indicates whether the server control’s child controls have been created. | 1.0,1.1, 2.0, 3.0, 3.5, 4.0 |
| ClientID | Returns the server control identifier generated by ASP.NET. The ClientID value is generated by concatenating the ID value of the control and the UniqueID value of its parent control. If the ID value of the control is not specified, an automatically generated value is used. Each part of the generated ID is separated by an underscore character (_). | 1.0,1.1, 2.0, 3.0, 3.5, 4.0 |
| ClientIDSeparator | The ClientID value is generated by concatenating the ID value of the control and the UniqueID value of its parent control. Each part of the generated ID property is separated by the ClientIDSeparator property value. The value always returns an underscore (_). | 1.0,1.1, 2.0, 3.0, 3.5, 4.0 |
| Context | Software developer can use this property to access the HttpContext object for the current Web request. Using properties of the object software developer can access objects Application, Session, Request, Response, etc. which contain information about the current HTTP request. The object provides methods that allow him to get configuration information and to set or clear errors related to the request. | 1.0,1.1, 2.0, 3.0, 3.5, 4.0 |
| Controls | This property allows software developer to access programmatically to the instance of the ControlCollection class for any server control. Using it he/she can add/remove controls to/from the collection or iterate through the server controls in the collection. | 1.0,1.1, 2.0, 3.0, 3.5, 4.0 |
| ControlStyle | This property is used to encapsulate all properties of the WebControl class that specify the appearance of the control, such as BorderColor and Font. This property is used primarily by control developers. | 1.0,1.1, 2.0, 3.0, 3.5, 4.0 |
| ControlStyleCreated | This property is used primarily by control developers. Returns a true value if a Style object has been created for the ControlStyle property; otherwise false. | 1.0,1.1, 2.0, 3.0, 3.5, 4.0 |
| CssClass | Software developer can use this property to specify the CSS class to render on the client for the Web Server control. This property will render on browsers for all controls. On browsers that do not support CSS, setting the CssClass property will have no effect. | 1.0,1.1, 2.0, 3.0, 3.5, 4.0 |
| DesignMode | This property returns true to indicate that the control is being used in the context of a designer. Software developer’s custom controls can use this property when design-time behavior is different than run-time behavior. | 2.0, 3.0, 3.5, 4.0 |
| Enabled | Software developer should set this property to true when he/she wants to specify or determine whether a control is functional. When developer sets to false, the control appears dimmed, preventing any input from being entered in the control. Notes:
|
1.0,1.1, 2.0, 3.0, 3.5, 4.0 |
| EnableTheming | This property overrides Control. EnableTheming.
The property indicates whether themes are enabled for a specified control. When the property’s value is true, the application’s theme directory is searched for control skins to apply. If for the particular control skin does not exist in the directory, skins are not applied. When the property’s value is false, the theme directory is not searched and the contents of the SkinID property are not used. |
2.0, 3.0, 3.5, 4.0 |
| EnableViewState | Software developer must enable view state for the server control setting its value to true if he/she wants to maintain its state across HTTP requests. Sometimes is better to set value of this property to false if for example Web application is loading a database request into a server control. In this case application performance will be improved. | 1.0,1.1, 2.0, 3.0, 3.5, 4.0 |
| Events | This read-only property returns a list of event handler delegates for the control. The type of this property is EventHadlerList, which uses a linear search algorithm to find entries in the list of delegates. When the list of delegates is large, finding entries with this property will be slow, because a linear search algorithm is inefficient when working with a large number of entries. | 1.0,1.1, 2.0, 3.0, 3.5, 4.0 |
| FileBytes | This property returns an array of the bytes in a file that is specified by using a FileUpload control. The control does not automatically read the file from the client. Web developers should provide a control or mechanism to allow the end user to submit the specified file. Before calling the property, Web developer should use the HasFile property to verify that the FileUpload control contains a file to upload. If the HasFile returns true, the FileBytes property can be used. If it returns false, a message to the end user indicating that the control does not contain a file should be displayed. Without error-handling code to verify that a file exists, an attempt to save a nonexistent file throws an HttpException exception. | 2.0, 3.0, 3.5, 4.0 |
| FileContent | This property returns a Stream object which points to a file to upload using the FileUpload control. | 2.0, 3.0, 3.5, 4.0 |
| FileName | This property returns the name of a file (which does not include the path of the file) on a client to upload using the FileUpload control. | 2.0, 3.0, 3.5, 4.0 |
| Font | Software developer can use this property to specify the font properties of the Web Server control. This property includes subproperties that can be accessed declaratively in the form of Property-Subproperty (for example Font-Bold) or programmatically in the form of Property.Subproperty (for example Font.Bold).
All but one subproperty will render in browsers prior to Microsoft Internet Explorer version 4 for all controls. They are: Bold, Italic, Name, Names, Strikeout, Underline, and Size (but only named font sizes, such as Small, Smaller, and so on, will work).
|
1.0,1.1, 2.0, 3.0, 3.5, 4.0 |
| ForeColor | Software developer can use this property to to specify the foreground color of the Web server control. The foreground color is usually the color of the text. This property will render on browsers earlier than Microsoft Internet Explorer version 4 for all controls, except the Image, AdRotator, HyperLink and LinkButton. | 1.0,1.1, 2.0, 3.0, 3.5, 4.0 |
| HasAttributes | This property returns true when the WebControl instance has attribute name/value pairs. The attribute pairs can be set either in the property or in the view state. | 2.0, 3.0, 3.5, 4.0 |
| HasChildViewState | Software developer can use this property to verify that any child controls of the server control are storing view-state information. Using it in this way he/she can avoid unnecessary calls to the ClearChildViewState method. | 1.0,1.1, 2.0, 3.0, 3.5, 4.0 |
| HasFile | This property returns a value true indicating whether the FileUpload control contains a file. Web developer should use this property to verify that a file to upload exists before performing operations on the file. | 2.0, 3.0, 3.5, 4.0 |
| Height | This property is used to specify the height of the Web server control. When software developer sets this property he/she should use combination of a numeric value followed by type of measurement: px (for pixels) or % (for percentage) and so on.This property does not render for all controls in browsers earlier than Microsoft Internet Explorer version 4. Controls that do not render this property in earlier browsers include Label, HyperLink, LinkButton, and any validation controls. The CheckBoxList, RadioButtonList and DataList also do not render this property in earlier browsers when their RepeatLayout property is set to RepeatLayout.Flow. Furthermore, only unit types of Pixel and Percentage are supported in earlier browsers. | 1.0,1.1, 2.0, 3.0, 3.5, 4.0 |
| ID | Web developers can set this property by declaring ID attribute in the opening tag of an ASP.NET server control. Another possible way to set it is programmatically. If this property is not specified for a server control, either declaratively or programmatically, Web developer can obtain a reference to the control through its parent control’s Controls property. | 1.0,1.1, 2.0, 3.0, 3.5, 4.0 |
| IdSeparator | Software developer can’t use this property directly from his/her code, because it supports the .NET Framework infrastructure. The character contained in this property ( by default $ ) is used to separate the control identifiers for child controls. The ID separator character is appended to the ID property. | 2.0, 3.0, 3.5, 4.0 |
| IsChildControlStateCleared | This property has value true if children of this control do not use control state; otherwise, false. | 2.0, 3.0, 3.5, 4.0 |
| IsEnabled | This property returns true if the Enabled property is true for this control and any containing controls. | 2.0, 3.0, 3.5, 4.0 |
| IsTrackingViewState | This property returns value true if the control is marked to save changes to its view state; otherwise, false.
|
1.0,1.1, 2.0, 3.0, 3.5, 4.0 |
| IsViewStateEnabled | This property returns value true if view state is enabled for the control; otherwise false. View state can be enabled at the page, container, or control level. When view state is disabled at the page or container level, view state is disabled for all controls contained by the page or container. The property indicates whether view state is enabled by pages, containers, or controls. In some cases it is possible values for the EnableViewState property and the IsViewStateEnabled property to be different. For example, if the Page containing the control has view state disabled, the EnableViewState property can be true while the IsViewStateEnabled property is false. Notes: Developers will set the EnableViewState property to indicate whether they are using view state with your control. Web developers can use this property in their code to determine whether view state is enabled for their control and all containers. | 2.0, 3.0, 3.5, 4.0 |
| LoadViewStateByID | This property returns value true if the control loads its view state by ID; otherwise, false. Its default value is false. | 2.0, 3.0, 3.5, 4.0 |
| NamingContainer | Using this property software developer can get a reference to the server control’s naming container, which creates a unique namespace for differentiating between server controls with the same Control.ID property value. | 1.0,1.1, 2.0, 3.0, 3.5, 4.0 |
| Page | Provides a reference to the web page that contains this control as a System.Web.UI.Page object. This property’s value reflects the name of the .aspx file that contains the server control. | 1.0,1.1, 2.0, 3.0, 3.5, 4.0 |
| Parent | This property provides a reference to the control that contains this control. If the control is placed on the page directly (rather than inside another control), it will return a reference to the page object. | 1.0,1.1, 2.0, 3.0, 3.5, 4.0 |
| PostedFile | This property returns the underlying HttpPostedFile object for a file that is uploaded by using the FileUpload control. Web developer can use this property to access additional properties on the uploaded file. Web developer can use the ContentLength property to get the length of the file. He/she can use the ContentType property to get the MIME content type of the file. In addition, he/she can use the PostedFile property to access the FileName property, the InputStream property, and the SaveAs method. | 2.0, 3.0, 3.5, 4.0 |
| Site | Using this property software developer can get information about the container that hosts the current control when rendered on a design surface. A site binds a Component object to a Container object and enables communication between the two. It also provides a way for the container to manage its components. | 1.0,1.1, 2.0, 3.0, 3.5, 4.0 |
| SkinID | This property overrides Control.SkinID.
Web developer can get or set the skin to apply to the control. Skins available to a control are contained in one or more skin files in a theme directory. The SkinID property specifies which of these skins to apply to the control. A skin is specific to a particular control i.e. software developer cannot share skin setting between controls of different types. If developer does not set the SkinID property, a control uses the default skin if one is defined. |
2.0, 3.0, 3.5, 4.0 |
| Style | Web developer can use this property to get a collection of text attributes that will be rendered as a style attribute on the outer tag of the Web server control. This property will render on all browsers for all controls. | 1.0,1.1, 2.0, 3.0, 3.5, 4.0 |
| TabIndex | With this number software developer can control the tab order. The control with a TabIndex of zero has the focus when the page first loads. If end user presses Tab his/her focus will be moved to the control with the next lowest TabIndex. This property is available only in Internet Explorer 4.0 and higher. | 1.0,1.1, 2.0, 3.0, 3.5, 4.0 |
| TagKey | Web developers can use this property to get the HtmlTextWriterTag value that corresponds to this Web server control. This property is used primarily by control developers. | 1.0,1.1, 2.0, 3.0, 3.5, 4.0 |
| TagName | Web developers can use this property to get the name of the control tag. This property is used primarily by control developers. | 1.0,1.1, 2.0, 3.0, 3.5, 4.0 |
| TemplateControl | This property is used to get or set a reference to the template that contains this control. | 2.0, 3.0, 3.5, 4.0 |
| TemplateSourceDirectory | Software developer can use this property to get the path to the page or user control that contains the current control. If the web page is installed in https://www.somesite.com/apps/application1 the property will return “apps/application1”. | 1.0,1.1, 2.0, 3.0, 3.5, 4.0 |
| ToolTip | This property displays a text message when the end users hover the mouse above the control. | 1.0,1.1, 2.0, 3.0, 3.5, 4.0 |
| UniqueID | This property can be used to get the unique, hierarchically qualified identifier for the server control. This property differs from the ID property, in that the UniqueID property includes the identifier for the server control’s naming container. This identifier is generated automatically when a page request is processed. This property is particularly important in differentiating server controls contained within a data-binding server control that repeats as Repeater, DataList, DetailsView, FormView, and GridView Web server controls. | 1.0,1.1, 2.0, 3.0, 3.5, 4.0 |
| ViewState | Web developers can use this property to get a dictionary of state information that allows them to save and restore the view state of a server control across multiple requests for the same page. | 1.0,1.1, 2.0, 3.0, 3.5, 4.0 |
| ViewStateIgnoresCase | This property returns true if StateBag object is insensitive; otherwise, false. Its default value is false. | 1.0,1.1, 2.0, 3.0, 3.5, 4.0 |
| Visible | Web developers can use this property to get or set a value that indicates whether a server control is rendered as UI on the page. If the control is visible on the page this property will has value true; otherwise false. | 1.0,1.1, 2.0, 3.0, 3.5, 4.0 |
| Width | This property is used to specify the width of the Web server control. When software developer sets this property he/she should use combination of a numeric value followed by type of measurement: px (for pixels) or % (for percentage) and so on.This property does not render for all controls in browsers earlier than Microsoft Internet Explorer version 4. Controls that do not render this property in earlier browsers include Label, HyperLink, LinkButton, and any validation controls. The CheckBoxList, RadioButtonList and DataList also do not render this property in earlier browsers when their RepeatLayout property is set to RepeatLayout.Flow. Furthermore, only unit types of Pixel and Percentage are supported in earlier browsers. | 1.0,1.1, 2.0, 3.0, 3.5, 4.0 |