Microsoft KB Archive/266087

= PRB: Cannot Use Script to Manipulate INPUT TYPE=File Value =

Article ID: 266087

Article Last Modified on 5/11/2006

-

APPLIES TO


 * Microsoft Internet Explorer 4.0 128-Bit Edition
 * Microsoft Internet Explorer 4.01 Service Pack 2
 * Microsoft Internet Explorer 4.01 Service Pack 1
 * Microsoft Internet Explorer 4.01 Service Pack 2
 * Microsoft Internet Explorer 5.0
 * Microsoft Internet Explorer 5.01
 * Microsoft Internet Explorer (Programming) 5.01 SP1
 * Microsoft Internet Explorer 5.5

-



This article was previously published under Q266087



SYMPTOMS
If you use an INPUT TYPE=File element in an HTML FORM element, you cannot set a file name programmatically, regardless if you use script or set the VALUE property of the INPUT element to a default value.



CAUSE
Because INPUT TYPE=File allows arbitrary files to be uploaded from a user's computer to a remote server, setting this field programmatically is considered a security risk and is not supported.



RESOLUTION
Uploading content from a user's computer without his or her knowledge is contrary to the security paradigms of Web development. The user should be informed whenever content is going to be transferred off their computer, and the user should be given every opportunity to control or cancel the operation.

If you require such functionality in your Web-based application, use an ActiveX control that is marked unsafe for scripting and/or unsafe for initialization. (The author of the control is responsible for telling users that the control is unsafe because, by definition, uploading files are unsafe. You can sign the control to ask users to trust your control.)



Steps to Reproduce Behavior
  In any text editor, create the following HTML file, and save the file as TestFileSubmit.htm: 

 Automating Input=File Dialog Boxes



function load { frm1.file1.value = &quot;C:\config.sys&quot;; }







 <INPUT type=&quot;File&quot; name=&quot;file1&quot; value=&quot;c:\boot.ini&quot;></INPUT> </FORM>

</BODY>

</HTML> </li> <li>In Internet Explorer 4.x or 5.x, load the page. Notice that none of the values that are assigned to the INPUT TYPE=File element appear in the Edit box.</li></ol>

<div class="references_section">