Writing File Upload Handlers With LLMs in November 2026: Cap the Size Before You Read, Check the Real File Type, and Never Trust the Filename
File uploads look like a small feature. A form field, a route, a call to save the file somewhere. That is exactly why they go wrong so often when you ask an LLM to write them. The model will happily produce a handler that works for the one JPEG you test with, and quietly accepts a 4 GB request, trusts a filename like ../../app/config.py , and serves an uploaded HTML file back from your own domain. This guide walks through how to get a model to write an upload handler you can actually ship: what to put in the prompt, which rules to state up front, what to look for in the code it returns, and how to test it with hostile input before real users find the gaps. Why upload code is a bad place to accept the first draft Most generated code fails loudly. Upload code fails quietly. A handler that reads the whole request into memory works fine in development and falls over when someone sends a large file. A handler that checks the extension instead of the content passes every happy-path tes...