FileReference.postData property for file uploads

On Flash file uploads, instead of populating your session ID in URL, you might use a specific property of the FileReference class.

What most people do is this:

import flash.net.FileReference;

var allTypes:Array = new Array();
var imageTypes:Object = new Object();
imageTypes.description = "Images (*.jpg, *.jpeg, *.gif, *.png)";
imageTypes.extension = "*.jpg; *.jpeg; *.gif; *.png";
allTypes.push(imageTypes);

var listener:Object = new Object();

listener.onSelect = function(file:FileReference):Void {
    trace("onSelect: " + file.name);
    if(!file.upload("https://tekkie.dev/upload.php?sessionid="+_root.sessionid)) {
        trace("Upload failed!");
    }
}

var fileRef:FileReference = new FileReference();
fileRef.addListener(listener);
fileRef.browse(allTypes);

Note the above file upload URL. In theory it makes the upload handler script vulnerable as session ID is exposed and is being read from URL. So instead of GET one should be using POST:

import flash.net.FileReference;

var allTypes:Array = new Array();
var imageTypes:Object = new Object();
imageTypes.description = "Images (*.jpg, *.jpeg, *.gif, *.png)";
imageTypes.extension = "*.jpg; *.jpeg; *.gif; *.png";
allTypes.push(imageTypes);

var listener:Object = new Object();

listener.onSelect = function(file:FileReference):Void {
    trace("onSelect: " + file.name);
    file.postData = "sessionid="+_root.sessionid;
    if(!file.upload("https://tekkie.dev/upload.php")) {
        trace("Upload failed!");
    }
}

var fileRef:FileReference = new FileReference();
fileRef.addListener(listener);
fileRef.browse(allTypes);