File Uploading

File upload forms require a different encoding.

diagram what has to be true for an upload to arrive mermaid

  flowchart TD
  A["form enctype='multipart/form-data'"] --> B{"set?"}
  B -->|no| C["fields arrive in request.form, request.files is EMPTY"]
  B -->|yes| D["browser sends the file parts"]
  D --> E{"body under MAX_CONTENT_LENGTH?"}
  E -->|no| F["413 Request Entity Too Large -- your view never runs"]
  E -->|yes| G["request.files['field_name']"]
  G --> H{"a file was actually chosen?"}
  H -->|no| I["an empty FileStorage with filename '' -- check for it"]
  H -->|yes| J["secure_filename, validate, then save"]

Three things all have to line up, and missing any one of them produces an empty request.files rather than an error. The form must be multipart, the input needs a name attribute that matches the key you look up, and the server has its own size limit that rejects the body before your view ever runs.

HTML form

html

<form method="post" enctype="multipart/form-data">
  <input type="file" name="photo" />
  <button type="submit">Upload</button>
</form>

Flask route

python

from flask import Flask, request
 
app = Flask(__name__)
 
 
@app.route("/upload", methods=["GET", "POST"])
def upload():
    if request.method == "POST":
        file = request.files.get("photo")
        if not file:
            return "No file uploaded", 400
 
        # saving comes next (see secure filenames)
        return "File received", 200
 
    return "Upload form"

Why request.form doesn’t contain files

Files are streamed separately and exposed via:

• request.files

Common pitfalls

• Forgetting enctype="multipart/form-data" → files missing
• Not setting size limits
• Accepting any file type blindly

In a real app, validate:

• allowed file extensions
• MIME type
• file size