checking the size of fileupload (validation)

- MAX_FILE_SIZE field: http://www.tizag.com/htmlT/htmlupload.php[^]. But it is not supported by all browsers.
- File Api[^]. Only working in some modern browsers, see sample here: http://stackoverflow.com/questions/3717793/javascript-file-upload-size-validation[^]
- Using a plugin, like this one: swfupload[^]

All these can be disabled or worked around on client side. Thus you should always handle file size checking also on server side. This is not as easy in asp.net and iis as it is in php on apache.
First of all, you can set file upload limit in iis: http://www.webtrenches.com/post.cfm/iis7-file-upload-size-limits[^].
But that's not all.

In case of smaller limits, you can simply set up the iis limit to a little bit higher than 4MiB (the limit itself is not for the attachment size, it is for the whole request), and check size from code - redirect to an error page if necessary.

In case of really large files, or slow connection, you have to consider also the request processing timeout, and you will need a http handler module to do the work, like described here: http://www.ideosity.com/ourblog/post/ideosphere-blog/2009/11/17/handling-(and-squashing)-large-file-uploads-in-asp.net[^] (this is vb.net, but not hard to transcribe). You can use this approach in your case too.

http://msdn.microsoft.com/en-us/library/aa479405.aspx[^]