Welcome to WebmasterWorld Guest from 3.80.4.76

Forum Moderators: open

Message Too Old, No Replies

IE and input type="file"

Typing a value prevents form from submitting

     
3:25 pm on Mar 23, 2007 (gmt 0)

Senior Member from US 

WebmasterWorld Senior Member fotiman is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month

joined:Oct 17, 2005
posts:5021
votes: 26


I'm trying to find more information on this, but so far searches have not been very effective (too many non-related hits).

If you have a form with a file input type, and you enter an invalid value into the text box, IE6 (don't know about IE7) will not even attempt to submit the form when you press a submit button. Is this by design? A bug? And is there any way to somehow tie into this and inform the user?

Here's an example. Try typing in some gibberish and pressing submit. Nothing happens.


<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"
"http://www.w3.org/TR/html4/strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset:utf-8">
<title>File Input Test</title>
</head>
<body>
<form action="example.php" enctype="multipart/form-data" method="post">
<div>
<input type="file" name="foo">
<input type="submit" name="sub" value="Save">
</div>
</form>
</div>
</body>
</html>

*edit*:
It looks like if the value begins with a real path, then the form submits. For example, as long as you include "C:\" at the beginning, it will submit. But if you just type in "somefile.txt" it will not.

[edited by: Fotiman at 3:39 pm (utc) on Mar. 23, 2007]

11:41 am on Mar 25, 2007 (gmt 0)

New User

10+ Year Member

joined:Mar 25, 2007
posts:8
votes: 0



<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset:utf-8">
<title>File Input Test</title>
<script language="javascript">
function checkform(){
if (theForm.foo.value!= "")
{var s,ss;
var s =theForm.foo.value;
ss= s.substr(s.length-4,s.length);
if (ss!=".gif" && ss!=".jpg" && ss!=".bmp" &&ss!=".txt") //You can change this
{ alert("Only Support .gif .jpg .bmp .txt");
return false;
}
}
else
{
alert("Must input the file box!");
return false;
}
}
</script>
</head>
<body>
<form name="theForm" action="example.php" enctype="multipart/form-data" method="post" onSubmit="return checkform();">
<div>
<input type="file" name="foo">
<input type="submit" name="sub" value="Save">
</div>
</form>
</div>
</body>
</html>

I come form China ,so my english is very poor. :(

I hope you can understand what I mean. :)

8:21 am on Mar 26, 2007 (gmt 0)

Senior Member

WebmasterWorld Senior Member blobfisk is a WebmasterWorld Top Contributor of All Time 10+ Year Member

joined:Feb 25, 2002
posts:3185
votes: 0


That looks like a nice script, but I'd be inclined to use ORs rather than ANDs:

if (ss!=".gif" [b][red][/red][/b] ss!=".jpg" [b][red][/red][/b] ss!=".bmp" [b][red][/red][/b] ss!=".txt") //You can change this

8:42 am on Mar 26, 2007 (gmt 0)

Full Member

10+ Year Member

joined:Feb 4, 2004
posts:305
votes: 0


BlobFisk, the &&'s are correct, tugang is checking for invalid extensions. When checking for valid extensions the would indeed be the one to use but in this case the && is the one to use.
2:41 pm on Mar 26, 2007 (gmt 0)

Senior Member from US 

WebmasterWorld Senior Member fotiman is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month

joined:Oct 17, 2005
posts:5021
votes: 26


That's interesting, but not exactly where I was going with my question.

In my original example, if I enter this into the text box for the file:

C:\invalidfile.gif

The form will attempt to submit, even if there is no such file. That is, it will POST to the server. However, if I enter this:

invalidfile.gif

The form will not even attempt to submit. It seems to be some sort of built in validation in IE that's checking to see if this really could be a valid filename path (though it doesn't actually verify that it is a valid filename path).

Obviously, IE is performing some sort of post-onsubmit validation that prevents the form from submitting. Is there any way to tie into that (maybe attaching a listener to some event)? I'm not sure what event that would be though.

7:09 am on Mar 27, 2007 (gmt 0)

New User

10+ Year Member

joined:Mar 25, 2007
posts:8
votes: 0


check the file is exist by script impossibility.
2:43 pm on Mar 27, 2007 (gmt 0)

Senior Member from US 

WebmasterWorld Senior Member fotiman is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month

joined:Oct 17, 2005
posts:5021
votes: 26


huh?
6:31 pm on Mar 27, 2007 (gmt 0)

Administrator

WebmasterWorld Administrator coopster is a WebmasterWorld Top Contributor of All Time 10+ Year Member

joined:July 31, 2003
posts:12555
votes: 3


I think tugang is stating that checking the file for existence is a scripting impossibility, which you likely already know.

I realize the point of the thread here and that being that you are wondering why MSIE is handling a file upload entry as it does. First, some results and some additional discoveries from my own testing (note: I tested this on both a Windows and a *nix installation, both with same results) ...

Side note: There is an orphan closing </div> in the original code snippet but even after removing that the MSIE browser handles things quite differently than I would expect.
You are correct in that any file name without a "valid" path will not even seem to prompt the browser to submit any form data whatsoever. However, as long as a "seemingly correct" filepath and filename are keyed into the form field, MSIE thinks it can do it's job. Here is what happens when I dump the $_FILES superglobal upon entry of a non-existent drive with a non-existent file. There is no "Z" drive on my test system and no file named "bogus.file", yet if I key "Z:\bogus.file" into the file field the browser yields this in a form submission and subsequent dump (using PHP for server-side processing):


[_FILES] => Array
(
[foo] => Array
(
[name] => bogus.file
[type] => application/octet-stream
[tmp_name] => C:\WINDOWS\TEMP\php2436.tmp
[error] => 0
[size] => 0
)

MSIE "thinks" it is all legit and tries to process accordingly. The most disturbing part of the form submission is the "error" index!

Value: 0; There is no error, the file uploaded with success.

Furthermore, if I use PHP to move the uploaded file I can successfully move the zero byte file to it's new location without issue! In PHP, if no file is selected for upload in your form, PHP will return $_FILES['foo']['size'] as 0, and $_FILES['foo']['tmp_name'] as none. Not the case here with the temporary file name therefore I realize that MSIE is actually creating a zero-byte temporary file and pushing it over to the server! Or at least that is what it is reporting to the server.

I tried a search myself to try and figure out how MSIE processes a form submission with input type=file and the closest I have come to any type of answer so far has been this security bulletin:

[microsoft.com...]

6:52 pm on Mar 27, 2007 (gmt 0)

Senior Member from US 

WebmasterWorld Senior Member fotiman is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month

joined:Oct 17, 2005
posts:5021
votes: 26



I think tugang is stating that checking the file for existence is a scripting impossibility, which you likely already know.

Yup. :)

Thanks for you post coopster. Looks like you've put a lot of thought into it.

I don't actually want any knowledge of the file and/or whether it exists or not. Instead, since IE won't submit the form if an invalid value is entered, I'd just like to somehow tie into IE's event handling mechanisms.

For example, suppose the user enters "Z:\bogus.file" which does not actually exist. I don't care whether the file exists or not. IE will at least submit the form. However, if the user enters "bogus.file", IE will START to process the form (the onsubmit event for the form will be fired), but it won't actually transmit any data. It's this particular case that I'm most interested in. I'd like to subscribe to whatever event IE is firing that's preventing the form from continuing, perhaps alerting the user that they've entered an invalid value for the file. I don't want to modify that value (but it might be nice if I could get a read-only copy just to alert the user).

So far, no luck. But thanks for you input.

7:19 pm on Mar 27, 2007 (gmt 0)

Administrator

WebmasterWorld Administrator coopster is a WebmasterWorld Top Contributor of All Time 10+ Year Member

joined:July 31, 2003
posts:12555
votes: 3


Are you using the Windows Firewall? I found some references from folks stating that Windows FW was their issue in this particular case. If so, try disabling it and see it is the cause.
3:19 pm on Mar 28, 2007 (gmt 0)

Senior Member from US 

WebmasterWorld Senior Member fotiman is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month

joined:Oct 17, 2005
posts:5021
votes: 26


No, Windows Firewall is turned off.
 

Join The Conversation

Moderators and Top Contributors

Hot Threads This Week

Featured Threads

Free SEO Tools

Hire Expert Members