HTML input type="file": File Upload Controls

Imagine asking a friend for some information on a webpage. The field should explain exactly what you need.

What You Need to Know

This example uses the browser’s built-in file control, so you do not have to create a picker from scratch.

In this example: choose a profile image file.

Try the Example

Take a look at the example. We’ll explain the important lines right below it.

<form action="/upload" method="post" enctype="multipart/form-data">
    <label for="profile-photo">Choose a profile picture</label>
    <input id="profile-photo" name="profile-photo" type="file" accept="image/png,image/jpeg">
    <button type="submit">Upload picture</button>
</form>

Let’s Read the Code

type: Type changes what sort of control or resource the browser uses.
<form>: The form groups controls and identifies where submitted data goes.
<label>: The label tells people what the input is for. A matching for/id pair makes the label clickable.
for: For connects a label or output with a control by ID.

What the example shows: The browser lets the visitor choose a local file; the form must use multipart/form-data to send it.

What Happens in the Browser?

The HTML controls work in the browser, but saving an answer requires the example action path to be handled by a real server.

What happens to the file? Choosing a file does not upload it immediately. The browser sends it when the form is submitted to an endpoint that accepts file uploads. The server must check the file type, size, and permissions before storing it.

Your Turn

Add multiple to allow choosing more than one file; remember the server must support it.

Common Beginner Mistakes

Copying the example without giving the fields a clear label and a usable name.
The accept hint is not security validation; check the real file on the server.

Key Takeaways

A control needs a clear label and, when submitted, a meaningful name and value.
type: Type changes what sort of control or resource the browser uses.
Remember that HTML form rules help the visitor, but server-side code must decide whether received data is valid.