# Upload sanitisation

> Why some image files may contain executable instructions, what is removed on upload, and why the check belongs before storage rather than in the browser.

Synonyms: upload sanitization, file sanitisation, sanitizing, upload cleaning, upload checking

Some file formats are more than an image. By definition they may contain instructions that a browser executes while displaying them. As long as the file comes from a trusted source that is harmless; the moment somebody else can upload, it becomes an open route into your own site.

Cleaning therefore happens before storage, not at display time. Executable parts and outbound references are removed from the file while what is shown stays intact. Anyone looking at the result notices no difference — what is missing was never meant for the eye anyway.

Timing is what matters: a check that only happens in the visitor's browser arrives too late and can be bypassed. And it belongs at every point where files come in — not only the obvious one in the editing area, but also forms that accept attachments.

---
Source: https://btlabs.dev/en/glossary/upload-sanitisation
Last-Modified: 2026-08-16T06:05:06.013Z
Languages: [de](https://btlabs.dev/llms/de/glossary/upload-bereinigung) · [it](https://btlabs.dev/llms/it/glossary/sanificazione-degli-upload)
See also: [llms.txt](https://btlabs.dev/llms.txt) · [ai.txt (Policy)](https://btlabs.dev/ai.txt) · [identity.json](https://btlabs.dev/identity.json)