一、 安全性比较低，把文本文件1.txt改成1.jpg照样可以上传，但其实现方法容易理解，实现也简单，所以网上很多还是采取这种方法。Boolean fileOk = false;string path = Server.MapPath("~/images/");//判断是否已经选取文件if (FileUpload1.HasFile){//取得文件的扩展名,并转换成小写string fileExtension = System.IO.Path.GetExtension(FileUpload1.FileName).ToLower();//限定只能上传jpg和gif图片string[] allowExtension = { ".jpg", ".gif" };//对上传的文件的类型进行一个个匹对int j = 0;for (int i = 0; i < allowExtension.Length; i++){if (fileExtension == allowExtension[i]){fileOk = true;return;}else{j++;}}if (j > 0){Response.Write("<script>alert('文件格式不正确');</script>");return;}}else{Response.Write("<script>alert('你还没有选择文件');</script>");return;}//如果扩展名符合条件，则上传if (fileOk){FileUpload1.PostedFile.SaveAs(path + FileUpload1.FileName);Response.Write("<script>alert('上传成功');</script>");}二、不检测文件后缀而是检测文件MIME内容类型。Boolean fileOk = false;string path = Server.MapPath("~/images/");//判断是否已经选取文件if (FileUpload1.HasFile){//取得文件MIME内容类型string type = this.FileUpload1.PostedFile.ContentType.ToLower();if (type.Contains("image"))    //图片的MIME类型为"image/xxx"，这里只判断是否图片。
               {fileOk = true;}else{Response.Write("<script>alert('格式不正确')</script>");}}else{Response.Write("<script>alert('你还没有选择文件');</script>");}//如果扩展名符合条件，则上传if (fileOk){FileUpload1.PostedFile.SaveAs(path + FileUpload1.FileName);Response.Write("<script>alert('上传成功');</script>");}三、可以实现真正意义上的文件类型判断try{//判断是否已经选取文件if (FileUpload1.HasFile){if (IsAllowedExtension(FileUpload1)){string path = Server.MapPath("~/images/");FileUpload1.PostedFile.SaveAs(path + FileUpload1.FileName);Response.Write("<script>alert('上传成功');</script>");}else{Response.Write("<script>alert('您只能上传jpg或者gif图片');</script>");}}else{Response.Write("<script>alert('你还没有选择文件');</script>");}}catch (Exception error){Response.Write(error.ToString());}#endregion}
//真正判断文件类型的关键函数public static bool IsAllowedExtension(FileUpload hifile){System.IO.FileStream fs = new System.IO.FileStream(hifile.PostedFile.FileName, System.IO.FileMode.Open, System.IO.FileAccess.Read);System.IO.BinaryReader r = new System.IO.BinaryReader(fs);string fileclass = "";//这里的位长要具体判断.byte buffer;try{buffer = r.ReadByte();fileclass = buffer.ToString();buffer = r.ReadByte();fileclass += buffer.ToString();}catch{}r.Close();fs.Close();if (fileclass == "255216" || fileclass == "7173")//说明255216是jpg;7173是gif;6677是BMP,13780是PNG;7790是exe,8297是rar
            {return true;}else{return false;}}