How do I upload files through a form?
Last checked 31 Aug 2026
Short answer
Use Lovable Cloud's (or Supabase's) storage buckets: ask Lovable to add a file input, restrict file type and size, and upload to a storage bucket with access rules controlling who can read the file later.
File uploads need storage, not just a database
Files themselves don't belong in a Postgres table — they go into object storage, with the table holding a reference (a path or URL) to the stored file. Lovable Cloud (and Supabase) both include storage buckets for this.
Prompt for the whole flow
Add a file upload field to the form for attaching a photo. Restrict it to JPG/PNG under 5MB. Upload the file to a storage bucket and save the resulting file path in the
enquiriestable alongside the rest of the submission.
Lovable will create the bucket, add the upload logic, and apply access rules so files aren't publicly readable unless you want them to be.
Access control matters
Decide up front who should be able to view uploaded files:
- Public bucket: fine for things like public profile photos.
- Private bucket with signed URLs: needed for anything sensitive (ID documents, private attachments) — only generate a temporary access link when an authorised user requests it.
Make the uploads bucket private. Only allow admins to generate a link to view an uploaded file.
Validate before upload, not after
Check file type and size client-side for instant feedback, but also enforce it server-side/in the bucket policy — a client check alone can be bypassed by someone calling the upload API directly.
What usually goes wrong
- No size limit: large files can slow uploads and inflate storage costs quickly; always specify a maximum.
- Public buckets by default: don't assume a new bucket is private — say so explicitly.
- No upload progress or error state: for anything beyond a tiny file, ask for a progress indicator and a clear failure message if the upload fails.
- Forgetting cleanup: if a form submission is deleted, the associated file in storage isn't removed automatically unless you ask for that.
Sources
Was this answer helpful?
Related questions
- AnswerWhere do Lovable form submissions go?Nowhere, by default — a form only exists on the front end until you connect a destination: a database table (Lovable Cloud/Supabase) and/or an outgoing email via an integration like Resend.
- AnswerHow do I email form submissions to myself?Connect an email integration (Resend is the standard option), then ask Lovable to trigger a server-side function that emails you the form data whenever it's submitted.
- AnswerHow do I save form submissions to a database?Connect Lovable Cloud (or your own Supabase project), then ask Lovable to create a table for submissions and wire the form's submit handler to insert a row into it, with row-level security limiting who can read the data.
- AnswerWhy isn't my Lovable contact form working?Check, in order: whether a submit handler is actually wired up, whether a backend (Lovable Cloud/Supabase) is connected if you're saving data, whether client-side validation is blocking submission, and the browser console for errors.