Detailed answer
For an ordinary upload, use a file input, POST, and multipart/form-data encoding.
Accept guides the file picker but does not validate safety. The server needs to check size, actual content, permissions, and storage rules. Treat a selected file as untrusted even when its extension looks familiar.
Example
<form action="/upload" method="post" enctype="multipart/form-data"><label for="photo">Image</label><input id="photo" name="photo" type="file" accept="image/png,image/jpeg"><button>Upload</button></form>
Understanding the behavior
A file upload needs a file input with a name and an appropriate multipart form submission. The browser sends the selected file data, while a server endpoint must accept, inspect and store it. The accept attribute is a chooser hint rather than a security boundary.
Practical implementation notes
On the server, enforce size and type rules, generate safe storage names and avoid executing uploaded files. Test a small allowed file and a rejected file so failure feedback is understandable.
How to check it
Inspect method and enctype, then confirm the request body uses multipart/form-data.
Expected result
The request includes file data; the server still validates content and size.
Watch out: A file extension does not prove the real file type.
Read the reference ↗