diff --git a/packages/server/server.go b/packages/server/server.go
index 2f70433..1d8320c 100644
--- a/packages/server/server.go
+++ b/packages/server/server.go
@@ -3,8 +3,10 @@ package server
 import (
 	"fmt"
 	"html/template"
+	"io"
 	"log"
 	"net/http"
+	"os"
 
 	"streifling.com/jason/sicherheitsunterweisung/packages/db"
 	"streifling.com/jason/sicherheitsunterweisung/packages/types"
@@ -15,6 +17,7 @@ func DisplayTable(db *db.DB) http.HandlerFunc {
 		bs, err := db.ReadAll()
 		if err != nil {
 			_ = fmt.Errorf("DisplayTable: %v\n", err)
+			return
 		}
 		template.Must(template.ParseFiles("templates/index.html", "templates/table.html")).Execute(w, bs)
 	}
@@ -25,6 +28,7 @@ func DisplayResults(db *db.DB) http.HandlerFunc {
 		bs, err := db.ReadByName(r.PostFormValue("search"))
 		if err != nil {
 			_ = fmt.Errorf("DisplayResults: db.ReadByName(r.PostFormValue()): %v\n", err)
+			return
 		}
 		template.Must(template.ParseFiles("templates/table.html")).ExecuteTemplate(w, "rows", bs)
 	}
@@ -70,7 +74,33 @@ func SubmitForm(db *db.DB, i, j *int64) http.HandlerFunc {
 		bs, err := db.ReadAll()
 		if err != nil {
 			_ = fmt.Errorf("SubmitForm: db.ReadAll(): %v\n", err)
+			return
 		}
 		template.Must(template.ParseFiles("templates/index.html", "templates/table.html")).Execute(w, bs)
 	}
 }
+
+func Upload(db *db.DB) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		r.ParseMultipartForm(10 << 20) // 10 MiB
+
+		tmpFile, handler, err := r.FormFile("questionaire")
+		if err != nil {
+			http.Error(w, err.Error(), http.StatusInternalServerError)
+			return
+		}
+		defer tmpFile.Close()
+
+		file, err := os.Create(handler.Filename)
+		if err != nil {
+			http.Error(w, err.Error(), http.StatusInternalServerError)
+			return
+		}
+		defer file.Close()
+
+		if _, err := io.Copy(file, tmpFile); err != nil {
+			http.Error(w, err.Error(), http.StatusInternalServerError)
+			return
+		}
+	}
+}