The parameter returned in multipart form data when accessed the first time is the filename of the file uploaded (like you said, JUST the filename). You need to ensure that you are eliminating illegal characters, usually with a RegEx of some type. Then you can execute something like this:

while (my $bytesread = read($file, my $buffer, 1024)) {
                        print OUTFILE $buffer;
                    }
[download]

to get the actual data from the file (you have to have defined OUTFILE, usually as the filename you just got from the form parameter). There isn't a real way to get multipart form data to send you the full path to the file on the users computer, nor do you need it.

Check out this node for more great info.

---

Anyway, no drug, not even alcohol, causes the fundamental ills of society. If we're looking for the source of our troubles, we shouldn't test people for drugs, we should test them for stupidity, ignorance, greed and love of power.

--P. J. O'Rourke