I used
Now I would like to restrict this by accepting only .pdf and .xls files.
When I click the s
Unfortunately, there is no guaranteed way to do it at time of selection.
Some browsers support the accept attribute for input tags. This is a good start, but cannot be relied upon completely.
You can use a cfinput and run a validation to check the file extension at submission, but not the mime-type. This is better, but still not fool-proof. Files on OSX often have no file extensions or users could maliciously mislabel the file types.
ColdFusion's cffile can check the mime-type using the contentType property of the result (cffile.contentType), but that can only be done after the upload. This is your best bet, but is still not 100% safe as mime-types could still be wrong.