You can do multiple checking for your file upload control. 1) Checking the extension of file (.aspx, .exe, .doc). This can be implemented by Regex. 2) Actually check the file header or definition type (ex: gif, word, image, etc, xls). Sometimes file extension is not sufficient. 3) Limit the file size...