不能使用脚本操作INPUTTYPE=File的value

最新推荐文章于 2022-06-10 17:05:28 发布

wonder4

最新推荐文章于 2022-06-10 17:05:28 发布

阅读量3.3k

点赞数

分类专栏：项目文章标签： file 脚本 input paradigms scripting behavior

项目专栏收录该内容

68 篇文章 0 订阅

订阅专栏

PRB: Cannot Use Script to Manipulate INPUT TYPE=File Value

View products that this article applies to.

Article ID	:	266087
Last Review	:	May 11, 2006
Revision	:	3.0

This article was previously published under Q266087

SYMPTOMS

If you use an INPUT TYPE=File element in an HTML FORM element, you cannot set a file name programmatically, regardless if you use script or set the VALUE property of the INPUT element to a default value.

Back to the top

CAUSE

Because INPUT TYPE=File allows arbitrary files to be uploaded from a user's computer to a remote server, setting this field programmatically is considered a security risk and is not supported.

Back to the top

RESOLUTION

Uploading content from a user's computer without his or her knowledge is contrary to the security paradigms of Web development. The user should be informed whenever content is going to be transferred off their computer, and the user should be given every opportunity to control or cancel the operation.

If you require such functionality in your Web-based application, use an ActiveX control that is marked unsafe for scripting and/or unsafe for initialization. (The author of the control is responsible for telling users that the control is unsafe because, by definition, uploading files are unsafe. You can sign the control to ask users to trust your control.)

Back to the top

MORE INFORMATION

Steps to Reproduce Behavior

In any text editor, create the following HTML file, and save the file as TestFileSubmit.htm:

 <HTML>

<HEAD>
<TITLE>Automating Input=File Dialog Boxes</TITLE>

<SCRIPT>

function load() {
	frm1.file1.value = "C:/config.sys";
}

</SCRIPT>

</HEAD>

<BODY bgcolor="#ffffff">

<FORM name="frm1" action="/post.asp" METHOD="POST" 

ENCTYPE="multipart/form-data">
<INPUT type="File" name="file1" value="c:/boot.ini"></INPUT>
</FORM>


</BODY>

</HTML>

2. In Internet Explorer 4.x or 5.x, load the page. Notice that none of the values that are assigned to the INPUT TYPE=File element appear in the Edit box.

网络上有的一种解决办法，我试了，并不怎么好使。跟安全性有关系，如果安全性高，代码也是无法运行的。

<SCRIPT LANGUAGE="JavaScript">
document.getElementById('filename').focus();
var WshShell=new ActiveXObject("WScript.Shell")
WshShell.sendKeys("test.txt")
}

wonder4

关注

0
点赞
踩
0

收藏

觉得还不错? 一键收藏
0
评论
不能使用脚本操作INPUTTYPE=File的value

PRB: Cannot Use Script to Manipulate INPUT TYPE=File ValueView products that this article applies to.function loadTOCNode(){} Article ID :
复制链接

扫一扫