diff --git a/tanksd.go b/tanksd.go
index 208f3eb..b40dd5a 100644
--- a/tanksd.go
+++ b/tanksd.go
@@ -10,6 +10,7 @@ import (
 	"os"
 	"os/exec"
 	"path"
+	"slices"
 	"time"
 )
 
@@ -56,6 +57,11 @@ func (ts *TankState) ServeHTTP(w http.ResponseWriter, req *http.Request) {
 		return
 	}
 
+	if !slices.Contains(validFilenames, name) {
+		http.Error(w, "Invalid filename", http.StatusNotFound)
+		return
+	}
+
 	tankDir := path.Join(ts.dir, id)
 	if tankDir == ts.dir {
 		http.Error(w, "Invalid tank ID", http.StatusBadRequest)
@@ -74,7 +80,7 @@ func (ts *TankState) ServeHTTP(w http.ResponseWriter, req *http.Request) {
 		return
 	}
 
-	fmt.Fprintln(w, "file written")
+	fmt.Fprintf(w, "%s/%s: written\n", id, name)
 }
 
 func (ts *TankState) WriteRound(now time.Time, round []byte) error {
diff --git a/www/designer.mjs b/www/designer.mjs
index cbafc76..411c0f5 100644
--- a/www/designer.mjs
+++ b/www/designer.mjs
@@ -12,6 +12,14 @@ function deg2rad(angle) {
     return angle*Math.TAU/360;
 }
 
+function debug(text) {
+    let el = document.querySelector("#debug")
+    if (el) {
+        el.textContent = text
+        setTimeout(() => el.textContent = "", 2 * Second)
+    }
+}
+
 function update(ctx) {
     let color = document.querySelector("[name=color]").value
     let sensors = []
@@ -45,7 +53,7 @@ function update(ctx) {
     tank.draw_tank()
 }
 
-function formSubmit(event) {
+async function formSubmit(event) {
     event.preventDefault()
 
     let formData = new FormData(event.target)
@@ -70,15 +78,29 @@ function formSubmit(event) {
     let id = formData.get("id")
     let apiURL = new URL(`tanks/${id}/`, location)
 
-    // Fill slots
-    for (let k in files) {
-        let v = files[k]
-        for (let e of document.querySelectorAll(`slot[name="${k}"]`)) {
-            e.textContent = v
-        }
-    }
-    for (let e of document.querySelectorAll("slot[name=apiurl]")) {
-        e.textContent = apiURL
+    // Did the submit button have a "data-script" attribute?
+    if (event.submitter.dataset.script !== undefined) {
+        await navigator.clipboard.writeText(`#! /bin/sh
+
+curl -X PUT -d '${files.name}' ${apiURL}name
+curl -X PUT -d '${files.color}' ${apiURL}color
+curl -X PUT -d '${files.author}' ${apiURL}author
+curl -X PUT -d '${files.sensor0}' ${apiURL}sensor0
+curl -X PUT -d '${files.sensor1}' ${apiURL}sensor1
+curl -X PUT -d '${files.sensor2}' ${apiURL}sensor2
+curl -X PUT -d '${files.sensor3}' ${apiURL}sensor3
+curl -X PUT -d '${files.sensor4}' ${apiURL}sensor4
+curl -X PUT -d '${files.sensor5}' ${apiURL}sensor5
+curl -X PUT -d '${files.sensor6}' ${apiURL}sensor6
+curl -X PUT -d '${files.sensor7}' ${apiURL}sensor7
+curl -X PUT -d '${files.sensor8}' ${apiURL}sensor8
+curl -X PUT -d '${files.sensor9}' ${apiURL}sensor9
+curl -X PUT --data-binary @- ${apiURL}program <<'EOD'
+${files.program}
+EOD
+`)
+        debug("Upload script copied to clipboard.")
+        return
     }
 
     // Upload files
@@ -100,16 +122,11 @@ function formSubmit(event) {
             }
             if (pending == 0) {
                 let duration = (performance.now() - begin).toPrecision(2)
-                let debug = document.querySelector("#debug")
-                if (debug) {
-                    let msg = `tank uploaded in ${duration}ms`
-                    if (errors > 0) {
-                        msg = msg + `; ${errors} errors`
-                    }
-                    debug.textContent = msg
-
-                    setTimeout(() => debug.textContent = "", 2 * Second)
+                let msg = `tank uploaded in ${duration}ms`
+                if (errors > 0) {
+                    msg = msg + `; ${errors} errors`
                 }
+                debug(msg)
             }
         })
     }
diff --git a/www/index.html b/www/index.html
index f693f1c..5ac6722 100644
--- a/www/index.html
+++ b/www/index.html
@@ -60,40 +60,12 @@
           </div>
 
           <input type="submit" value="Upload">
+          <input type="submit" value="Copy upload script" data-script>
 
           <div id="debug"></div>
         </div>
 
       </fieldset>
     </form>
-      
-    
-    <h2>Upload using curl</h2>
-    <p>
-      You can use <samp>curl</samp> to upload your tank,
-      if you want.
-    </p>
-    <p>
-      The server does no syntax checking on what you upload.
-      You'll have to wait until the next round to see if you made a mistake.
-    </p>
-    <pre lang="sh">
-#! /bin/sh
-
-curl -X PUT -d '<slot name="name">fred the tank</slot>' <slot name="apiurl">https://server/tanks/a1b2c3d4/</slot>name
-curl -X PUT -d '<slot name="color">#ff0000</slot>' <slot name="apiurl">https://server/tanks/a1b2c3d4/</slot>color
-curl -X PUT -d '<slot name="sensor0">50 0 10 1</slot>' <slot name="apiurl">https://server/tanks/a1b2c3d4/</slot>sensor0
-curl -X PUT -d '<slot name="sensor1">360 0 5 0</slot>' <slot name="apiurl">https://server/tanks/a1b2c3d4/</slot>sensor1
-curl -X PUT -d '<slot name="sensor2">0 0 0 0</slot>' <slot name="apiurl">https://server/tanks/a1b2c3d4/</slot>sensor2
-curl -X PUT -d '<slot name="sensor3">0 0 0 0</slot>' <slot name="apiurl">https://server/tanks/a1b2c3d4/</slot>sensor3
-curl -X PUT -d '<slot name="sensor4">0 0 0 0</slot>' <slot name="apiurl">https://server/tanks/a1b2c3d4/</slot>sensor4
-curl -X PUT -d '<slot name="sensor5">0 0 0 0</slot>' <slot name="apiurl">https://server/tanks/a1b2c3d4/</slot>sensor5
-curl -X PUT -d '<slot name="sensor6">0 0 0 0</slot>' <slot name="apiurl">https://server/tanks/a1b2c3d4/</slot>sensor6
-curl -X PUT -d '<slot name="sensor7">0 0 0 0</slot>' <slot name="apiurl">https://server/tanks/a1b2c3d4/</slot>sensor7
-curl -X PUT -d '<slot name="sensor8">0 0 0 0</slot>' <slot name="apiurl">https://server/tanks/a1b2c3d4/</slot>sensor8
-curl -X PUT -d '<slot name="sensor9">0 0 0 0</slot>' <slot name="apiurl">https://server/tanks/a1b2c3d4/</slot>sensor9
-curl -X PUT --data-binary @- <slot name="apiurl">https://server/tanks/a1b2c3d4/</slot>program &lt;&lt;'EOD'
-<slot name="program">20 30 set-speed!</slot>
-EOD
-    </pre>
+  </body>
 </html>