Classic ASP File Uploads with UTF-8 and Unicode File Names
Garbled file names usually mean two parts of the application disagree about text encoding. Trace the name from the browser to the parser, database and response instead of applying a second conversion to every string.
Make the page and response agree
Save the ASP page as UTF-8 and configure a matching response code page and character set before writing output. Mixing a UTF-8 document with a different server-side string conversion can make a correct browser file name look corrupted after the response is rendered.
<%@ Language="VBScript" CodePage="65001" %>
<%
Response.CodePage = 65001
Response.Charset = "utf-8"
%>
<!doctype html>
<html lang="en">
<head><meta charset="utf-8"><title>Upload attachment</title></head>This fragment configures response text. It does not, by itself, repair an upload parser that decoded the incoming multipart headers incorrectly. Included files and parent pages also need a coherent encoding policy. Set the response settings before output has already been sent.
Preserve the multipart bytes until the parser decodes them
An uploaded file is binary data, while its name and ordinary form fields are text. Do not convert the whole multipart body into a Unicode string and then back into bytes to save it. That can damage the file even when its name appears correct. Use the uploader's supported parsing and file-copy APIs.
Test the installed uploader with accented Latin names, Chinese characters, spaces and emoji where your storage stack supports them. Browsers and older parsers can differ in how they represent non-ASCII header values. Capture the point where the text first changes; indiscriminately applying URLDecode or another UTF-8 conversion can corrupt a name that was already decoded.
Store a generated key and the original display name separately
Use a server-generated identifier for the stored object. Save the original name as metadata for display and downloads, after applying your length and character rules. This prevents a display name from becoming a path traversal instruction and avoids collisions when two users upload files called report.pdf.
If metadata goes into SQL Server, use appropriate Unicode column and parameter types. Database collation and supplementary-character support matter when your supported names include characters outside the basic multilingual plane. Test the actual database round trip, not merely the value shown before it is saved. Never concatenate a name into a SQL statement.
Encode at the output boundary
HTML-encode the display name when rendering it in a page. Build download URLs from an opaque attachment identifier instead of concatenating the original name into a path. When setting an attachment download header, use an implementation that supports international filenames correctly and rejects control characters.
- The uploaded bytes match the selected file after downloading.
- The stored metadata retains the expected Unicode characters.
- An ampersand or angle bracket in a name is shown as text, not markup.
- Two different files with the same display name remain distinct.
- Unsupported or overlong names produce a clear validation message.
Keep a useful diagnostic record
Log an upload identifier and the processing stage, then inspect the name at parsing, persistence and rendering boundaries in a controlled test. Avoid logging the entire request or file contents. If a migration changed the page encoding, do not silently rewrite old database values until you have established whether they contain damaged text or just were previously displayed incorrectly.
Common questions
Will Response.Charset fix every corrupted filename?
No. It controls how the response is interpreted. It cannot recover a name that was already decoded or stored incorrectly earlier in the request.
Should I remove every non-ASCII character?
That can hide the underlying bug and harm usability. Use generated storage keys and a documented display-name policy, then test the languages you intend to support.
Related guides and working examples
Official references
Examples describe the stated framework and application workflow. Check your installed component version and hosting configuration before adapting them.