Uploading Files Using CGI and Perl

[KevinR]

In firefox, the code works fine. But, while uploading a file using IE, the whole remote desktop path get's attached with the file name.

You can use File::Basename to get just the file name but beware that if the perl script runs on a Unix or Linux box you will need to translate the directory path delimiters that windows sends '\' to forward slashes '/' first so File::Basename will parse the filename out properly.

[Andrew Garrett]

This would introduce cross-site scripting, and depending on the server's configuration, arbitrary code execution vulnerabilities.

See tstarling.com/blog/2008/12/secure-web-uploads/ for full details.

[cjchavez]

Great tutorial - thanks for the info.

What can you do if you want to allow users to upload muliple files in one go, e.g., not just one picture, but a whole bunch?

[KevinR]

Great tutorial - thanks for the info.

What can you do if you want to allow users to upload muliple files in one go, e.g., not just one picture, but a whole bunch?

That would take some rewriting of the code from the tutorial to accomplish.

[dotmove]

pls am working on an application and i already have a form to post my data to my server.i have it in this form:

<form action = "../upload.cgi method "post"
   <text area name="Comments" rows=12 cols =78></text area>

then submit form

pls i need a cgi program to take care of the posted data and save it to a directory in my site in a text file: ../htdoc/dotmove.txt

how can i do this am new in this forum

Thanks!

Dotmove

[lchurch]

I'm trying to get this code to work on my windows system. Copied everything pretty much as laid out in the article, except to change some directories. When the form submits, I get a page with the CGI script listed. I set the permissions to allow execution. what am i missing?