一个自己写的真正判断文件格式,文件大小,而并不仅仅从扩展名来进行判断的上传方法,进一步加强防止软件或恶意的木马图片上传

 

 if (FileUpload1.HasFile)
        {
            string filename = myfunction.UploadPic(this.FileUpload1, myfunction.Getcompanylogopath());
            if (filename.IndexOf("您") != -1)
            {
                Page.RegisterClientScriptBlock("err", "<script language=javascript>alert('" + filename + "');</script>");
            }
            else
            {
              
            }
        }

 

 

public string UploadPic(FileUpload FileUpload1,string SavePath)
        {
            string filename = string.Empty;
            string retstr = string.Empty;
            if (FileUpload1.HasFile)
            {
                string dirpath = SavePath;
                filename = FileUpload1.FileName;
                string[] myfile = filename.Split('.');
                int maxkb = this.GetUploadPicturemax();
                string newfilename = string.Empty;
                string dotname = myfile[myfile.Length - 1].ToString().ToLower();
                string folder = DateTime.Now.Year.ToString() + DateTime.Now.Month.ToString() + DateTime.Now.Day.ToString();
                if (dotname != "gif" && dotname != "jpg" && dotname != "png")
                {
               
                    retstr = "您上传的文件格式错误,请使用gif,jpg或png文件";
                }
                else
                {
                    try
                    {
                        if (FileUpload1.PostedFile.ContentLength / 1024 > maxkb)
                        {
                            retstr = "对不起,您上传的图片文件太大,最大不能超过" + maxkb.ToString() + "kb";
                            
                        }
                        else
                        {

                            if (!System.IO.Directory.Exists(dirpath + folder))
                            {
                                System.IO.Directory.CreateDirectory(dirpath + folder);
                            }
                            Random myrdn = new Random();
                            newfilename = DateTime.Now.Year.ToString() + DateTime.Now.Month.ToString() + DateTime.Now.Day.ToString() + DateTime.Now.Hour.ToString() + DateTime.Now.Minute.ToString() + DateTime.Now.Second.ToString() + myrdn.Next(10000).ToString() + "." + dotname;
                            FileUpload1.SaveAs(dirpath + folder + "//" + newfilename);
                            newfilename = folder + "//" + newfilename;
                            //继续判断图片的大小是否在指定范围内

                            System.Drawing.Image image = System.Drawing.Image.FromFile(dirpath + newfilename);
                            if (image.RawFormat.Guid != System.Drawing.Imaging.ImageFormat.Gif.Guid && image.RawFormat.Guid != System.Drawing.Imaging.ImageFormat.Jpeg.Guid && image.RawFormat.Guid != System.Drawing.Imaging.ImageFormat.Png.Guid)
                            {
                                //删除图片
                                image.Dispose();
                                if (System.IO.File.Exists(dirpath + newfilename))
                                    System.IO.File.Delete(dirpath + newfilename);
                                retstr = "对不起,您上传的图象格式为非法,请勿上传未知图片格式";
                              
                            }
                            else
                            {
                                image.Dispose();
                                retstr = filename;
                            }
                        }
                    }
                    catch
                    {
                        retstr = "对不起,您上传的图象格式为非法,请勿上传未知图片格式";
                        if (System.IO.File.Exists(dirpath + newfilename))
                            System.IO.File.Delete(dirpath + newfilename);

                    }

                }

            }
            return retstr;   
        }