Member Avatar for phoenix_dwarf

I have a asp.net page with the following on the page:

<asp:FileUpLoad id="FileUpLoad1" runat="server" /><br />

but i need to get the pathname in that textbox to use with a stored procedure. Now the only thing i can get is the filename (not the path). Any ideas?

This is my code retrieving the filename:

string filename = FileUpLoad1.FileName.ToString();
            //string filepath = FileUpLoad1.;
            Label1.Text = filepath + filename;
            //DataAccess.UploadFlatFile(filepath , filename);

:-/

Edited by phoenix_dwarf because: n/a
  • 4 Contributors
  • 12 Replies
  • 4K Views
  • 8 Years Discussion Span
  • Latest Post Latest Post by Ibrahim_16

Dani AI

Generated

You cannot read the user’s real local path from an ASP.NET FileUpload. The server only receives a file name; modern browsers deliberately hide the client path (often showing C:\fakepath\...). Design your workflow to store where you save the file on the server, not the client-side path. See the FileUpload FileName remarks and the browser behavior for file inputs. FileUpload.FileName (Microsoft Learn) MDN: input type="file"

The IDE path you saw (e.g., ...\Common7\IDE\upload1.txt) happens because Path.GetFullPath("upload1.txt") resolves relative to the server process’s current working directory, not the client machine. That API turns a relative name into an absolute server path based on the current directory. Path.GetFullPath (Microsoft Learn)

A safe pattern is to sanitize the name and save to a known server folder, then persist that server path (or a virtual path) in your database:

if (FileUpload1.HasFile)
{
    var safeName = System.IO.Path.GetFileName(FileUpload1.FileName);
    var virtualPath = "~/Uploads/" + safeName;
    var physicalPath = Server.MapPath(virtualPath);
    FileUpload1.SaveAs(physicalPath);
    // store virtualPath in the database
}

Do not trust extensions or MIME type alone; both can be spoofed. Validate type and size, store uploads outside executable paths, and disable execute permissions on the upload directory. How to: Upload Files (Microsoft Learn) OWASP Input Validation Cheat Sheet Uploading Files (C#) (Microsoft Learn)

Recommended Answers

All 12 Replies

Member Avatar for phoenix911

any suggestions will be much appreciated

Member Avatar for phoenix_dwarf

just use:

string filepath = System.IO.Path.GetFullPath(FileUpLoad1.FileName);

:icon_mrgreen:

Member Avatar for phoenix_dwarf

just use:

string filepath = System.IO.Path.GetFullPath(FileUpLoad1.FileName);
Member Avatar for Geekitygeek

Alternatively you can use:

Fileupload1.PostedFile.FileName;

remember to mark the thread as solved if you have found an answer :)

Edited by Geekitygeek because: n/a
Member Avatar for phoenix911

this still doesnt work, as it only returns this

C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\upload1.txt
Member Avatar for phoenix911

instead of the actual path where it was on the client side....

Member Avatar for Geekitygeek

works perfetly for me : /
Can you post the rest of the code you used when trying it?

Member Avatar for phoenix911

which code would you need? lol as not being specific doesnt help me on what code to paste

Member Avatar for phoenix_dwarf

Well basically that all i have:

string filepath = "\'" + System.IO.Path.GetFullPath(FileUpLoad1.FileName)

The thing is in the FileUpload1 textbox it shows the correct path but when put in lable with above code it shows:
C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\upload1.txt

so i don't know why it's doing that?

Member Avatar for Geekitygeek

have you tried it with the code i posted?
I made a simple page with a FileUpload, a button and a label,
when i click the button it runs Label1.Text = Fileupload1.PostedFile.FileName; and it displays the full path and filename correctly.

Member Avatar for phoenix_dwarf

All i get in the lable is : upload1.txt..... not the full path(if i run your code)...weird!

Member Avatar for Ibrahim_16

It works only on old browser IE. Latest browsers do not reveal full path for security reasons. However, I'm sure there is a way out.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.