sol90 — Fri, 13 Oct 2006 00:54:17 +0000

Greg K;208531 wrote: The question here is if the browser actually sends the file "location" to the server. I imagine that for security reasons, it will not, but i could be wrong.

-Greg

Good point, Greg. I believe the RFC mentions security as an issue as well.

Quote: 8. Security Considerations

It is important that a user agent not send any file that the user has
not explicitly asked to be sent. Thus, HTML interpreting agents are
expected to confirm any default file names that might be suggested
with . Never have any hidden fields be
able to specify any file.

This proposal does not contain a mechanism for encryption of the
data; this should be handled by whatever other mechanisms are in
place for secure transmission of data, whether via secure HTTP, or by
security provided by MOSS (described in RFC 1848).

Once the file is uploaded, it is up to the receiver to process and
store the file appropriately.

Source: http://www.ietf.org/rfc/rfc1867.txt

mawooshen, I'm sure you probably know this already but here goes...

I did a bit of testing on XAMPP and it appears that the $_FILES array does not have the full path name of the file (it has the file name and a temporary file path). In addition, the RFC talks about the 'value' in (input type=file) only tells the browser of a default file name. Like I said in my previous reply, I wasn't able to get that working. I'm on windows, using php5, apache from xampp. You can try your luck on other setup environments, I suppose.

Anyone else have any input, I'm kind of curious to find a better way to do this.

Greg K — Thu, 12 Oct 2006 12:03:17 +0000

The question here is if the browser actually sends the file "location" to the server. I imagine that for security reasons, it will not, but i could be wrong.

-Greg

sol90 — Thu, 12 Oct 2006 10:01:39 +0000

Quote: 3.4 Interpretation of other attributes

The VALUE attribute might be used with tags for a
default file name. This use is probably platform dependent. It might
be useful, however, in sequences of more than one transaction, e.g.,
to avoid having the user prompted for the same file name over and
over again.

Source: http://www.ietf.org/rfc/rfc1867.txt

Two things:

1.
RFC was written in 1995. I can't find a more updated version. Which means either current browsers don't like to handle it, or there is a more recent version that I don't know about.

2.
Despite what the RFC says, I could not get PHP to "keep" the value inside the file input box. A possible workaround, depending on your requirements, is to keep the variable in sessions and output the filename above/below/beside the input box.

If someone knows a better way :light: , by all means please share! Thanks