Server-Side Validation

Demo uploads land in a temporary store and are swept after 60 minutes. To keep files, handle FileUploaded — see Single File for the complete save pattern.

Handle server-side validation using the FileValidating event on postback. This demo accepts normal files and rejects empty uploads, path traversal names, and .tmp files when you submit the page.

What you should see: the FileValidating server event runs your rules where they count - reject there and the file is never stored, whatever the client claimed.

Drag & drop files here, or paste from clipboard

Accepted

Rejected

<!-- .aspx markup -->
<au:AjaxFileUpload ID="Uploader1" runat="server"
 AutoUpload="true"
 ButtonText="Upload File"
 ShowProgress="true"
 OnFileValidating="Uploader1_FileValidating" />

<!-- Code-behind (.aspx.cs) -->
protected void Uploader1_FileValidating(object sender, FileValidatingEventArgs e)
{
 if (e.FileSize == 0)
 {
 e.Cancel = true;
 e.CancelReason = "Empty file.";
 return;
 }
 if (e.FileName.Contains(".."))
 {
 e.Cancel = true;
 e.CancelReason = "Invalid filename.";
 return;
 }
}