Member Avatar for sasindagi

how to create new folder for each user who uploads .doc,.txt,.png,.jpg into web server. user may select his own type of uploads file depending upon file extension new folder must be created.
eg: user wish to upload a .doc file
then i want to create dynamically
http://localhost/test/user1/doc/xyz.doc
test- name of project
user1-user name who has uploaded
doc- folder name becoz .doc file uploaded
xyz.doc- name of the file

  • 2 Contributors
  • 2 Replies
  • 89 Views
  • 1 Week Discussion Span
  • Latest Post Latest Post by sasindagi

Dani AI

Generated

@jasindagi and : the approach of creating a per-user folder is fine, but add explicit extension handling, validation, and security checks before saving anything. Key risks to address are path traversal, dangerous file types, permission problems, filename collisions, and serving uploaded files directly from the webroot.

Practical checklist:

  • Whitelist extensions (lowercase) and enforce a max file size.
  • Sanitize the user identifier used in paths (allow only letters, numbers, underscore/hyphen).
  • Build paths with Path.Combine rather than string concatenation to avoid malformed paths (Path.Combine).
  • Create missing folders with Directory.CreateDirectory and ensure the app pool identity has write permission (Directory.CreateDirectory).
  • Use a GUID or timestamp to avoid name collisions, and never trust the client-supplied filename for storage or serving.
  • Validate file contents (MIME and, for images/docs, magic bytes) in addition to extension. Follow the OWASP file upload guidance for detailed checks (OWASP File Upload Cheat Sheet).
  • Prefer storing files outside wwwroot and serve them through an authenticated handler if the files should not be public.

Example (ASP.NET/C#) for creating a per-user + per-extension folder and saving a file safely:

var allowed = new HashSet<string>{".doc",".docx",".txt",".jpg",".png"};
string safeUser = Regex.Replace(username ?? "anon", @"[^A-Za-z0-9_-]", "_");
var ext = Path.GetExtension(posted.FileName).ToLowerInvariant();
if (!allowed.Contains(ext)) throw new InvalidOperationException("Type not allowed");
var root = Server.MapPath("~/Uploads");
var target = Path.Combine(root, safeUser, ext.TrimStart('.'));
Directory.CreateDirectory(target);
var storedName = Guid.NewGuid().ToString("N") + ext;
posted.SaveAs(Path.Combine(target, storedName));

Test uploads locally, check IIS permissions, and log failures.

Recommended Answers

All 2 Replies

Member Avatar for jamello

Can the user successfully upload his files?
New folders can be created. Confirm and get back to me

Member Avatar for sasindagi

am creating new folder for each user who uploads any files. all the uploaded files will be in that folder.
here is sample
file upload

    if ((FileUpload1.PostedFile != null) && (FileUpload1.PostedFile.ContentLength > 0))
    {
        System.IO.Directory.CreateDirectory(Server.MapPath("Upload" + "/" + Request.Cookies["uname"].Value.ToString()));
        string a;
        string fn = System.IO.Path.GetFileName(FileUpload1.PostedFile.FileName);
        SaveLocation = "Upload" + "/" + Request.Cookies["uname"].Value.ToString() + "/" + fn;
        a = Server.MapPath("Upload" + "/" + Request.Cookies["uname"].Value.ToString()) + "/" + fn;
        try
        {
            FileUpload1.PostedFile.SaveAs(a);
        }
        catch (Exception ex)
        {
            Response.Write("Error: " + ex.Message);

        }

    }

here above code is used to create a new folder with his name.

Edited by mike_2000_17 because: Fixed formatting
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.