Re: INPUT type=file value=????
| From: | Richard Lynch | Date: | Tue, 21 Aug 2001 23:50:52 +0000 |
| Subject: | Re: INPUT type=file value=???? | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-63818@lists.php.net to get a copy of this message | ||
> The W3C HTM 4x spec(s) say that when using the file type on a form
> input element, "User agents may use the value of the value attribute
> as the initial file name."
They *MAY* use it? As in, if they feel like it?...
W3C has a lot of specs that have nothing to do with what the browsers have
actually implemented, it seems to me...
> Attachment #1: <INPUT NAME="s_attachment" TYPE="file"
> VALUE="d:\\test.txt">
There's no way it should let you specify full path. Too likely for somebody
to hack up something that would fool the user into submitting /etc/passwd or
something.
HTML may or may not need \ escaped... Maybe \\\\?
> Is this an oversight, did I miss something in the docs, or have I done
> something really stupid?
I've never seen this done on any site. Have you? Look at their HTML source
if you have.
--
WARNING richard@zend.com address is an endangered species -- Use
ceo@l-i-e.com
Wanna help me out? Like Music? Buy a CD: http://l-i-e.com/artists.htm
Volunteer a little time: http://chatmusic.com/volunteer.htm