限制用户上传带有特殊字符的文件答案

【问题标题】：Restrict user for uploading file with Special characters限制用户上传带有特殊字符的文件
【发布时间】：2015-08-19 20:04:16
【问题描述】：

目前这里发生的情况是，每当用户上传带有一些特殊字符（如 %、&、#）的文件时。它被上传并在下载时出现问题。

所以现在我想要的是，每当用户开始上传文件时，它应该在 JAVASCRIPT 中向他发出警告消息，说明请上传不带特殊字符的文件和空间。

这是我的 FileUpload 代码：-

<td style="width: 10%;" class="field">
<asp:fileupload id="fileUpload" runat="server" width="100%" />
<div id="divSText" runat="server" style="display: none">
    <asp:textbox id="txtSText" runat="server" textmode="MultiLine" width="80%" rows="9">
                    </asp:textbox>
</div>

另见后面的代码：-

protected void btnSave_Click(object sender, EventArgs e)
{
    string Datafile = ""; HttpPostedFile PF_File; string Filename = "";
    if (HidFlag.Value == "Add")
    {
        if (Directory.Exists(Server.MapPath("~/Payroll/Masters/FileAttachment/ESS/")) == false)
        {
            Directory.CreateDirectory(Server.MapPath("~/Payroll/Masters/FileAttachment/ESS/"));
        }
        if (Directory.Exists(Server.MapPath("~/Payroll/Masters/FileAttachment/ESS/" + Hid_Empcode.Value)) == false)
        {
            Directory.CreateDirectory(Server.MapPath("~/Payroll/Masters/FileAttachment/ESS/" + Hid_Empcode.Value));
        }
        if (Directory.Exists(Server.MapPath("~/Payroll/Masters/FileAttachment/ESS/" + Hid_Empcode.Value + "/" + ddlCategory.SelectedValue)) == false)
        {
            Directory.CreateDirectory(Server.MapPath("~/Payroll/Masters/FileAttachment/ESS/" + Hid_Empcode.Value + "/" + ddlCategory.SelectedValue));
        }
        if (fileUpload.PostedFile.FileName != "")
        {
            PF_File = fileUpload.PostedFile;
            Datafile = fileUpload.FileName;
            Filename = Datafile.Substring(Datafile.LastIndexOf("\\") + 1, Datafile.Length - Datafile.LastIndexOf("\\") - 1);
            PF_File.SaveAs(Server.MapPath((@"~/Payroll/Masters/FileAttachment/ESS/" + Hid_Empcode.Value + "/" + ddlCategory.SelectedValue + "/" + Filename)));

            string str_query = "insert into EMP_ATTACHED_DOCUMENTS(form_id, document_id, category_id, title, descriptions, file_name, file_path, pk1_value, delete_flag, creation_date, created_by) " +
                                      "values('" + Request.QueryString["form_id"] + "', '" + Request.QueryString["document_id"] + "', '" + ddlCategory.SelectedValue + "', '" +
                                       txtTitle.Text + "','" + txtDescription.Text + "','" + Filename + "','" +
                                      Server.MapPath((@"~/Payroll/Masters/FileAttachment/ESS/" + Hid_Empcode.Value + "/" + ddlCategory.SelectedValue + "/" + Filename)) + "','" +
                                      Request.QueryString["empcode"] + "', 'N', getdate(),'" + Request.QueryString["empcode"] + "' )";
            ObjPriDal.ExecuteNonQuery(str_query);
        }
    }
    else if (HidFlag.Value == "Edit")
    {
        ObjPriDal.ExecuteNonQuery("insert into EMP_ATTACHED_DOCUMENTS_H select getdate(), * From EMP_ATTACHED_DOCUMENTS where mkey=" + HidFileID.Value);
        ObjPriDal.ExecuteNonQuery("update EMP_ATTACHED_DOCUMENTS set title='" + txtTitle.Text + "', descriptions='" + txtDescription.Text + "' where mkey=" + HidFileID.Value);
    }
    ClientScript.RegisterStartupScript(this.GetType(), "CloseScript", "document.cookie = 'CAttachid=1'; window.open('FrmCrm_File_Attachment.aspx?form_id=" + Request.QueryString["form_id"] + "&document_id=" + Request.QueryString["document_id"] + "&category_id=" + Request.QueryString["category_id"] + "&empcode=" + Request.QueryString["empcode"] + "&mkey=" + Request.QueryString["mkey"] + "','_self');", true);
}

【问题讨论】：

参考这篇文章如何在 jquery goo.gl/z2mIAk 中获取文件名并使用 jQuery goo.gl/HJpJXs 上传文件所以通过获取文件名你可以验证

标签： javascript c# asp.net file-upload

【解决方案1】：

试试这个

<asp:fileupload id="fileUpload" runat="server" width="100%" />
<asp:Button Text="Save" ID="btnSave" runat="server" OnClientClick="javascript:addcheck();Validate();" />

javascript函数

<script type="text/javascript" language="javascript">
    function Validate()
            {

                var fileUpload= document.getElementById('<%= fileUpload.ClientID %>');                
                var myfile = fileUpload.value;               
                if(myfile.search(/[<>'\s+\"\/;`%]/)>0)
                {
                 alert('please upload the file without special characters and SPACES');
                 return false;
                }
                else
                {
                 alert('valid Format');
                 return true;
                }

            }
    </script>

【讨论】：