Issue with multipart/form-data

Question

I am not able to get values from both files and text input in a servlet when my form includes multipart/form-data. I am using the apache.commons.fileuploads for help with the uploads. Any suggestions. Also in the code below there are some things that I feel should be more efficient. Is there a better way to store these multiple files in a db.

public void performTask(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response)
    {
        boolean promo = false;
        Database db = new Database();
        Homepage hp = db.getHomePageContents();

        String part = ParamUtils.getStringParameter(request, "part", "");
        if(part.equals("verbage"))
        {
            String txtcontent = (String)request.getParameter("txtcontent");
            String promoheader = (String)request.getParameter("promoheader");
            String promosubheader = (String)request.getParameter("promosubheader");
            hp.setBodyText(txtcontent);
            hp.setPromoHeader(promoheader);
            hp.setPromoSubHeader(promosubheader);
            System.err.println(txtcontent);
        }
        else
        {

            boolean isMultipart = ServletFileUpload.isMultipartContent(request);
            if (!isMultipart) 
            {

            }
            else {
                FileItemFactory factory = new DiskFileItemFactory();
                ServletFileUpload upload = new ServletFileUpload(factory);
                List items = null;
                try {
                items = upload.parseRequest(request);
                //System.err.print(items);
                } catch (FileUploadException e) {
                e.printStackTrace();
                }

                Iterator itr = items.iterator();
                while (itr.hasNext()) {
                    FileItem item = (FileItem) itr.next();
                    if(item.getFieldName().equals("mainimg1"))
                    {
                        if(item.getName() !="") hp.setMainImg1(item.getName());
                    }
                    if(item.getFieldName().equals("mainimg2"))
                    {
                        if(item.getName() !="") hp.setMainImg2(item.getName());
                    }
                    if(item.getFieldName().equals("mainimg3"))
                    {
                        if(item.getName() !="") hp.setMainImg3(item.getName());
                    }
                    if(item.getFieldName().equals("promoimg1"))
                    {
                        promo = true;
                        if(item.getName() !="")
                        {
                            hp.setPromoImg1(item.getName());
                            try {
                                File savedFile = new File("/Library/resin-4.0.1/webapps/ROOT/images/promoImg1.jpg");
                                item.write(savedFile);
                                //System.err.print(items);
                            } catch (Exception e) {
                                    System.err.println(e.getMessage());
                            }
                        }
                    }
                    if(item.getFieldName().equals("promoimg2"))
                    {
                        if(item.getName() !="") 
                        {
                            hp.setPromoImg2(item.getName());
                            try {
                                File savedFile = new File("/Library/resin-4.0.1/webapps/ROOT/images/promoImg2.jpg");
                                item.write(savedFile);
                                //System.err.print(items);
                            } catch (Exception e) {
                                    System.err.println(e.getMessage());
                            }
                        }
                    }
                    if(item.getFieldName().equals("promoimg3"))
                    {
                        if(item.getName() !="")
                        {
                            hp.setPromoImg3(item.getName());
                            try {
                                File savedFile = new File("/Library/resin-4.0.1/webapps/ROOT/images/promoImg3.jpg");
                                item.write(savedFile);
                                //System.err.print(items);
                            } catch (Exception e) {
                                    System.err.println(e.getMessage());
                            }
                        }
                    }


                    System.err.println("FNAME =" + item.getFieldName() + " : " + item.getName());
                    if (item.isFormField()) {
                    } 
                    else {
                        try {
                            if(!promo)
                            {
                                String itemName = item.getName();
                                File savedFile = new File("/Library/resin-4.0.1/webapps/ROOT/images/"+itemName);
                                item.write(savedFile);
                            }
                            //System.err.print(items);
                        } catch (Exception e) {
                                System.err.println(e.getMessage());
                          }
                    }
                }
            }
        }


        db.updateHomePageContent(hp);

Answer 1

When using multipart/form-data, the normal input field values are not available by request.getParameter() because the standard Servlet API prior to version 3.0 doesn't have builtin facilities to parse them. That's exactly why Apache Commons FileUpload exist. You need to check if FileItem#isFormField() returns true and then gather them from the FileItem.

Right now you're ignoring those values in the code. Admittedly, the FileItem is a misleading name, if it was me, I'd called it MultipartItem or just Part representing a part of a multipart/form-data body which contains both uploaded fields and normal parameters.

Here's a kickoff example how you should parse a multipart/form-data request properly:

List<FileItem> items = new ServletFileUpload(new DiskFileItemFactory()).parseRequest(request);
for (FileItem item : items) {
    if (item.isFormField()) {
        // Process normal fields here.
        System.out.println("Field name: " + item.getFieldName());
        System.out.println("Field value: " + item.getString());
    } else {
        // Process <input type="file"> here.
        System.out.println("Field name: " + item.getFieldName());
        System.out.println("Field value (file name): " + item.getName());
    }            
}

Note that you also overlooked a MSIE misbehaviour that it sends the full client side path along the file name. You would like to trim it off from the item.getName() as per the FileUpload FAQ:

String fileName = item.getName();
if (fileName != null) {
    filename = FilenameUtils.getName(filename);
}