File Upload with ASP.NET






4.65/5 (201 votes)
This article shows you how work with uploading of the files using ASP.NET and C#.

Back in the ASP world, uploading files via a web page was a tricky problem. The problem was that due to the encryption type of the form used to submit the file from the client's browser, receiving such files on the server side was a complex task. Data had to be retrieved as a safe byte array and decrypted before it could be used. Most of the people resorted to 3rd party DLLs. A few wrote their own DLLs and some even wrote purely ASP solutions to this problem using VBScript. Fortunately for us, the .NET Framework SDK comes with a few classes that make uploading of the files simple from the web developer point of view. This article will demonstrate following concepts:
- How to set up a form for file uploading
- How to receive uploaded files on the server side
- How to save uploaded files to hard drive
- How to save uploaded files in a database
- How to retrieve a file that is stored in a database and return it to a client
- Security considerations running the demo project
Setting Up an HTML Form for File Uploading
The requirements for an HTML form to be able to upload files are very simple: you have to use multipart/form-data
encryption and you have to use method of post
.
<form id="Form1" method="post" runat="server" enctype="multipart/form-data">
HTML input control that is used to upload file has a simple type of file
.
<input id="filMyFile" type="file" runat="server">
This is all that needs to be done to an HTML form for a client to be able to submit a file to your ASP.NET application.
Receiving Uploaded Files
<INPUT TYPE="file"
corresponds to the System.Web.UI.HtmlControls.HtmlInputFile
type of object on the server side. So if you, like myself, are using a CodeBehind
architecture for your page you will have a member field definition similar to this in your class:
protected HtmlInputFile filMyFile;
HtmlInputFile
classes have a few different properties, but the only one that really concerns us here is PostedFile
. This property will tell us all we need to know about the file that had been uploaded to our server. The PostedFile
property is null
if no file was submitted by a client. So, we can simply check whether a file was sent by doing something like this:
if( filMyFile.PostedFile != null )
{
// File was sent
}
else
{
// No file
}
The PostedFile
property will contain a valid System.Web.HttpPostedFile
object if file indeed was uploaded. HttpPostedFile
provides us with 4 properties:
ContentLength
: size of uploaded file in bytesContentType
: MIME type of uploaded file, i.e. "image/gif"FileName
: full path to uploaded file on client's system, i.e. c:\Some folder\MyPicture.gifInputStream
: stream object that gives us access to uploaded data
Let's find out the size of the file:
// Get a reference to PostedFile object
HttpPostedFile myFile = filMyFile.PostedFile;
// Get size of uploaded file
int nFileLen = myFile.ContentLength;
Now that we know the size, we can move on to retrieving the data. First, we need to allocate a byte array to store the data:
// Allocate a buffer for reading of the file
byte[] myData = new byte[nFileLen];
Next, we can read the uploaded file in our buffer using the InputStream
object:
// Read uploaded file from the Stream
myFile.InputStream.Read(myData, 0, nFileLen);
At this point, we have successfully retrieved the uploaded file into a byte array called myData
. What to do with it next depends largely on the requirements of your application. I will show both saving the file to hard drive and to a database in the next sections.
Saving Uploaded Files to Disk
I wrote a simple function for my demo project that stores files to a disk:
// Writes file to current folder
private void WriteToFile(string strPath, ref byte[] Buffer)
{
// Create a file
FileStream newFile = new FileStream(strPath, FileMode.Create);
// Write data to the file
newFile.Write(Buffer, 0, Buffer.Length);
// Close file
newFile.Close();
}
I pass a full path of where I want a file to be stored and reference to a buffer with file data to this function. It uses the System.IO.FileStream
object to write a buffer to a disk. This very simplistic 3 lines of code approach will work in most cases. A couple of considerations here are: getting the filename of the uploaded file and the security. Since the FileName
property of PostedFile
is a full path to the uploaded file on a client's computer, we will probably want to use only the filename portion of that path. Instead of using some parsing techniques to look for backslashes and things like that, we can use a very convenient little utility class: System.IO.Path
.
string strFilename = Path.GetFileName(myFile.FileName);
Security is another matter. In my demo project, I store files in the same folder where the project is executed. In order for that to work, the ASPNET account (the account that is used to execute ASP.NET processes) has to have Write permissions on that folder. By default it does not, so you need to right-click the folder, go to the security tab and add the ASP.NET account to the list. Then grant write permissions to that account by checking the Write checkbox and click OK.
Saving Uploaded Files to a Database
The following function is used in my demo project to store uploaded files in the database:
// Writes file to the database
private int WriteToDB(string strName, string strType, ref byte[] Buffer)
{
int nFileID = 0;
// Create connection
OleDbConnection dbConn = new OleDbConnection(GetConnectionString());
// Create Adapter
OleDbDataAdapter dbAdapt = new OleDbDataAdapter("SELECT * FROM tblFile", dbConn);
// We need this to get an ID back from the database
dbAdapt.MissingSchemaAction = MissingSchemaAction.AddWithKey;
// Create and initialize CommandBuilder
OleDbCommandBuilder dbCB = new OleDbCommandBuilder(dbAdapt);
// Open Connection
dbConn.Open();
// New DataSet
DataSet dbSet = new DataSet();
// Populate DataSet with data
dbAdapt.Fill(dbSet, "tblFile");
// Get reference to our table
DataTable dbTable = dbSet.Tables["tblFile"];
// Create new row
DataRow dbRow = dbTable.NewRow();
// Store data in the row
dbRow["FileName"] = strName;
dbRow["FileSize"] = Buffer.Length;
dbRow["ContentType"] = strType;
dbRow["FileData"] = Buffer;
// Add row back to table
dbTable.Rows.Add(dbRow);
// Update data source
dbAdapt.Update(dbSet, "tblFile");
// Get newFileID
if( !dbRow.IsNull("FileID") )
nFileID = (int)dbRow["FileID"];
// Close connection
dbConn.Close();
// Return FileID
return nFileID;
}
The Access database that I used in the demo project has only one table tblFile
that has 5 fields defined as follows:
FileID – autonumber Filename – text 255 FileSize - long integer ContentType – text 100 FileData – OLE Object
The code in the above function is very straightforward. I create OleDbConnection
, OleDbDataAdapter
and DataSet
objects and then append a row to the only table in DataSet
. The important thing to note here is that the OleDbCommandBuilder
object needs to be created and initialized with a reference to the OleDbDataAdapter
object to build the insert query for us automatically. Also, if you would like to retrieve the newly assigned FileID of the file you have just stored in the database, you need to make sure you set the MissingSchemaAction
property of Adapter to MissingSchemaAction.AddWithKey
. That assures that the Primary Key/autonumber FileID field will be populated with the new ID when you call the Update
method of your DataAdapter
.
The local ASP.NET account has to have Write permissions to a database file in order for your code to succeed. If your file is placed anywhere under wwwroot
, you will need to manually give the database file all the necessary permissions before running my demo project.
Retrieving of a File from a Database
I used the same ASPX page to read and return file data out of the database in my demo project. I check for the FileID parameter being passed to a page. If it was passed, I know that I need to return a file rather than process the user's input:
private void Page_Load(object sender, System.EventArgs e)
{
// Check if FileID was passed to this page as a parameter
if( Request.QueryString["FileID"] != null )
{
// Get the file out of database and return it to requesting client
ShowTheFile(Convert.ToInt32(Request.QueryString["FileID"]));
}
}
The ShowTheFile
function does all the work here:
// Read file out of the database and returns it to client
private void ShowTheFile(int FileID)
{
// Define SQL select statement
string SQL = "SELECT FileSize, FileData, ContentType FROM tblFile WHERE FileID = "
+ FileID.ToString();
// Create Connection object
OleDbConnection dbConn = new OleDbConnection(GetConnectionString());
// Create Command Object
OleDbCommand dbComm = new OleDbCommand(SQL, dbConn);
// Open Connection
dbConn.Open();
// Execute command and receive DataReader
OleDbDataReader dbRead = dbComm.ExecuteReader();
// Read row
dbRead.Read();
// Clear Response buffer
Response.Clear();
// Set ContentType to the ContentType of our file
Response.ContentType = (string)dbRead["ContentType"];
// Write data out of database into Output Stream
Response.OutputStream.Write((byte[])dbRead["FileData"], 0, (int)dbRead["FileSize"]);
// Close database connection
dbConn.Close();
// End the page
Response.End();
}
I am using OleDbConnection
, OleDbCommand
and OleDbDataReader
objects to retrieve data. The next step is to clear the Response
output buffer to make sure that no other information is being sent to the client besides our file data. That will only work if buffering of your pages is turned on (default in ASP.NET). I set the ContentType
property of the Response
object to the content type of our file. Then I write file data into the Output stream of the Response
object. The important thing here is to call Response.End()
at the end to prevent farther processing of this page. We are done here and we do not want for other code to execute.
Security Considerations
Important:
Because my demo project writes files to disk or data to an Access database, you need to make sure that security permissions are set properly on folders and files where you want to write. Beta versions of .NET used the System
account to execute ASP.NET processes and it had access to everything on your computer. However, the final release of .NET runs all ASP.NET processes under a local ASP.NET account. That account needs to have Write permissions to all the folders and files that are being used to write data.
In order to make my demo project work under the .NET release version, you need to place it in a folder (anywhere under wwwroot
) and set the permissions of that folder as follows: Right-Click the folder, go to Properties, Security tab, make sure the local ASPNET account has Read and Write permissions on that folder. If not, Add local ASPNET account to the list and give it read and write permissions. Click OK.