> <INPUT TYPE=file ACCEPT="image/gif, image/tiff" NAME="image1">.
>
>I think this might be important to prevent accidental or malicious
>misuse.
But what is to prevent somebody from designing their own local HTML page
and changing the "ACCEPT=..." string? Then they could click on the "send"
button and be able to send different MIME types than the original
site/author intended. This is a generic problem with FORM arguments. The
only way around this is to set up the cgi-bin script reading the FORM
results to check the value of each input variable against a hard-coded set
of rules. If the MIME types listed as the "ACCEPT=..." arguments go
unchecked, you really don't have much security that guarantees those are
the only MIME types that can be sent. The security mechanism needs to be at
the server end, not the client end.
-Dave
------------------
David Ray Webmaster, engineer, musician, propeller head
daver@netcom.com WWW Home page: http://iia.org/~rayd/public.html
510-527-9010 PO Box 5631, Berkeley California 94705 USA Earth