Validating File Size and File Type Before Upload in ASP

Classic ASP guide · Updated 2026-08-16

Reject the 400 MB .exe before it leaves the browser — then reject it again on the server.

Two checks, two different jobs

People often ask whether validation belongs on the client or the server. It belongs on both, because the two checks exist for different reasons:

Validating file size

Set the ceiling once and the uploader enforces it in the browser and on the server:

<%
Dim uploader
Set uploader = new AspUploader
uploader.Name = "myuploader"
uploader.MaxSizeKB = 200                                 ' reject anything over 200 KB
uploader.FileTooLargeMsg = "Maximum size is 200 KB."
uploader.InsertText = "Select files (Max 200K)"
%>
<%= uploader.GetString() %>

Because the check happens before the transfer starts, an oversized file is rejected instantly — the user is not left watching a progress bar for ten minutes to be told no at the end.

Belt and braces: cap the request in web.config as well, so a direct post is capped too.

<asp maxRequestEntityAllowed="1048576" />

Validating file type

Name the extensions you accept. Everything else is rejected:

uploader.AllowedFileExtensions = "jpeg,jpg,gif,png,zip"
uploader.FileTypeNotSupportMsg = "Only images and ZIP archives are accepted."

You can also pre-filter the file dialog so the user mostly sees eligible files:

uploader.DialogFilter = "Image files|*.jpg;*.jpeg;*.png;*.gif|All files|*.*"

Checking the content, not the name

An extension is a claim. If it matters, verify the bytes after upload:

<%
Function IsRealImage(path)
    Dim stm, header, i, hex
    Set stm = Server.CreateObject("ADODB.Stream")
    stm.Type = 1                       ' binary
    stm.Open
    stm.LoadFromFile path
    header = stm.Read(8)
    stm.Close

    hex = ""
    For i = 1 To LenB(header)
        hex = hex & Right("0" & Hex(AscB(MidB(header, i, 1))), 2)
    Next

    IsRealImage = (Left(hex, 6)  = "FFD8FF") _
              Or  (Left(hex, 16) = "89504E470D0A1A0A") _
              Or  (Left(hex, 8)  = "47494638")
End Function
%>

Custom validation rules

Business rules — "no more than five files", "total under 50 MB", "file names must start with the order number" — go in the client-side select handler, then again on the server.

<script type="text/javascript">
function CuteWebUI_AjaxUploader_OnSelect(files) {
    var total = 0;

    for (var i = 0; i < files.length; i++) {
        total += files[i].FileSize;

        if (!/^ORD-\d{6}/.test(files[i].FileName)) {
            alert(files[i].FileName + " must start with the order number.");
            return false;          // cancel the whole selection
        }
    }

    if (total > 50 * 1024 * 1024) {
        alert("Total upload size must stay under 50 MB.");
        return false;
    }
}
</script>

And the matching server-side check, which is the one that actually counts:

<%
Dim list, i, mvcfile, total
list  = Split(Request.Form("myuploader"), "/")
total = 0

If UBound(list) > 4 Then
    Response.Write "At most 5 files, please."
Else
    For i = 0 To UBound(list)
        Set mvcfile = uploader.GetUploadedFile(list(i))
        total = total + mvcfile.FileSize

        If Left(mvcfile.FileName, 4) <> "ORD-" Then
            Response.Write "Rejected: " & Server.HTMLEncode(mvcfile.FileName)
            mvcfile.Delete
        End If
    Next

    If total > 52428800 Then Response.Write "Total too large."
End If
%>

There is a live custom-validation demo showing both halves working together.

Write error messages people can act on

Every message the uploader shows is a property you can set. Use them — the defaults are generic by necessity, and a specific message removes a support email:

uploader.FileTooLargeMsg      = "That file is {0}. The limit is 10 MB - try compressing it."
uploader.FileTypeNotSupportMsg = "We accept JPG, PNG and PDF. That file is {0}."
uploader.MaxFilesLimitMsg     = "Up to 20 files per submission."
uploader.CancelUploadMsg      = "Cancel this upload"
uploader.UploadingMsg         = "Uploading, please keep this page open..."

• Say what the limit is, not just that it was exceeded.
• Say which file failed when several are queued.
• Suggest the fix — "compress it", "save as JPG".
• Reject at selection time, never after a long transfer.

Frequently asked questions

Can I check file size before the upload starts?

Yes. The browser knows the size the moment the file is selected, so an oversized file is rejected without sending a byte.

Is client-side validation enough?

No, never. It is bypassed by posting directly to the handler. Treat it purely as a convenience layer.

How do I restrict uploads to images only?

Set AllowedFileExtensions to the image extensions you accept, and verify the magic-number bytes on the server for anything security-sensitive.