It is true, even if you do not want to hear it. Only MS IE sends the entire file name including drive letter and directories, all other browsers I know, including Firefox, Netscape, Opera and Konqueror, send only the file name. Copy the following file into a CGI enabled directory of a webserver as uploadtest.cgi and see for yourself: Open http://server/cgi-bin/uploadtest.cgi, choose any file, and click the submit button.

#!/usr/bin/perl -Tw
use strict;
use CGI qw(:all);
use Data::Dumper;

if (request_method() eq 'POST') {
        my $f=param('f');
        my $info=uploadInfo($f);
        print
                header(),
                start_html(),
                h1('Upload Metadata'),
                pre(escapeHTML(Dumper($info))),
                end_html();
} else {
        print
                header(),
                start_html(),
                start_multipart_form(),
                filefield(-name=>'f',-size=>50),
                submit(),
                end_form(),
                end_html();
}

[download]

Result with Firefox 3.0.8:

$VAR1 = {
          'Content-Type' => 'application/octet-stream',
          'Content-Disposition' => 'form-data; name="f"; filename="win
+.ini"'
        };

[download]

Result with IE 6.0.2800.1106:

$VAR1 = {
          'Content-Type' => 'application/octet-stream',
          'Content-Disposition' => 'form-data; name="f"; filename="C:\
+\WINNT\\win.ini"'
        };

[download]

OK, let's be paranoid and let's assume Lincoln D. Stein and me added some evil code into CGI.pm just to make your life harder. So let's get rid of CGI.pm and look at the raw, unparsed data. Copy the following script as uploadtest2.cgi into the CGI-enabled directory of the webserver:

#!/usr/bin/perl -Tw
use strict;

print
        "Content-Type: text/html\015\012\015\012";
if ($ENV{'REQUEST_METHOD'} eq 'POST') {
        print
                "<html><body><plaintext>";
        print while <STDIN>;
} else {
        print
                '<html><body>',
                '<form method="post" action="" enctype="multipart/form
+-data">',
                '<input type="file" name="f" size="50">',
                '<input type="submit">',
                '</form></body></html>';

}

[download]

Result with FF:

-----------------------------114782935826962
Content-Disposition: form-data; name="f"; filename="win.ini"
Content-Type: application/octet-stream

# file content here

[download]

Result with IE:

-----------------------------7d936e1f40214
Content-Disposition: form-data; name="f"; filename="C:\WINNT\win.ini"
Content-Type: application/octet-stream

# file content here

[download]

Alexander

--
Today I will gladly share my knowledge and experience, for there are no sweeter words than "I told you so". ;-)

In reply to Re^3: FileParse is NOT working correctly by afoken
in thread FileParse is NOT working correctly by rrtrems

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.