SWFUpload - The Back End

I've received some more feedback and I've finished my first implementation of SWFUpload R3 in one of my own websites (which is on an Intranet so, unfortunately, I can't show it off).


Issues of note:

• My code uses document.getElementById to access the Flash movie. I received a report that this doesn't work in Firefox on OS X. document.embeds was recommended as an alternative. The original SWFUpload used a similar method. If you use document.embeds make sure you test in IE on Windows. IE used the "Object" tag rather than the "Embed" tag.
• Using SWFUpload in FireFox behind a Proxy that requires HTTP Authentication does not work for me. It does prompt for a username/password but will not accept it. In fact Flash locks up Firefox and you have to retype your blog posts from scratch.
• You can still force the IE Forms issue from the original SWFUpload if you insist on loading the flash inside a form without using the window.onload event. Don't do it, that was the whole point of SWFUpload R3.
• In my testing I found that Flash in Firefox (2.0) does not send the Firefox cookies to the upload_backend file. It seems to send the IE cookies instead. This seems like a security issue, but maybe it's just happening to me. I should do some more testing. However, in many environments if your cookies aren't sent then you will have lots of problems with user authentication and sessions.

Build the Back-End

Receiving and processing the uploaded file is a bit tricky. At least it was for me since I had to work around the FireFox Flash Cookie issue I experienced (and explained above).

Here are some main points to remember:

• You may not be able to rely on the cookies that flash sends (for Sessions and authentication)
• The only way to notify SWFUpload of an error in the upload is to return an appropriate HTTP status code. You will probably want to send a HTTP 500 status and then handle the error SWFUpload sends to the page.
• You can send values to the upload backend using the query string. E.g. upload_backend : "upload.php?fileid=ABCDEFG0123456789&bob=john".
• Each upload is sent via a separate request. You don't have to worry about handling multiple uploads. You only have to handle the one upload in the Filedata post value.
  

SWF Upload sends the following data to the backend:

• Filedata: This is the name of the file upload and contains all the data about the file.
  
• Filename: This contains the name of the file. It is kind of redundant.
  
• Upload: In my testing this always contains the string "Submit Query". I have no idea what it is for.

Code Samples:

ASP.Net Sample:

try
{
  Request.Files["Filedata"].SaveAs("/path/and/file/name.ext");
}
catch
{
  Response.Status = 500;
}

ASP Sample:

if (Request.Upload.Files.Count > 0) then
  if (Not Request.Upload.Files("uploadedfile").SaveAs(Server.MapPath(FileName), True)) then
      Response.Status = 500
  end if
end if

ColdFusion sample:

<cffile action="upload" destination="/path/and/file/name.ext" filefield="form.filedata">

PHP Sample:

if (!move_uploaded_file($_FILES['Filedata']['tmp_name'], "/path/and/file/name.ext")) {
  header("HTTP/1.0 500 Internal Server Error");
}

I have not tested these samples. They are built based on sample code from around the web. Feel free to suggest better samples if you've got them.