由于安全原因,你可以“填充”文件上载现场的内容。 而且,这意味着每提交表格时,档案就会重新上载,这并不好。

相反的:

• Create a file upload field with name file_upload.
• On the server-side, process the upload in any case, even if the rest of the form validation fails.
• If the form validation failed, but the file was uploaded, insert a hidden input into the form with name file containing the name of the just uploaded file.
• Display a user-visible indication that the file is okay. If it s an image, display a thumbnail version of it. If it s any other file, display its filename and/or icon.
• If the user chooses to upload a different file in the file_upload field, process the upload and store the new value in file.

Pseudocode:

<?php
    $file = null;
    if (!empty($_POST[ file ])) {
        $file = $_POST[ file ];
    }
    if (!empty($_FILES[ file_upload ])) {

        // process upload, save file somewhere

        $file = $nameOfSavedFile;
    }

    // validate form
?>


<input type="file" name="file_upload" />
<input type="hidden" name="file" value="<?php echo $file; ?>" />
<?php
    if (!empty($file)) {
        echo "File: $file";
    }
 ?>

Important note

该机制可允许任何用户自行申请其他用户的档案,在服务器上填入“<>.file>名称”。 您将确保上载的档案与特定用户明确相关,以避免这一问题。

文档输入领域只有读写,才能为它们确定初步价值。

你可以卸下文件,显示档案名称,而不是档案箱。 为记住这些领域,你可以使用“SESSION”变量。