I just see this line of code in VB in one file .aspx
FileUpload.SaveAs(sPath & "/" & FileUpload.FileName)
This line save a file that an user uploaded. It use the SaveAs method. I was worried about the sPath because the user can edit it.
The user can only save image, so it check the filename extension. I thought someone can use a null character to save another file, like:
Fortunately, this don't work. But is there another way to manipulate? Can someone send another way of null character?
As far I know, I list this types of null character
There is more?