Question

I have a form where users can upload files, and I’d like to name the file something along the lines of [id]_[lastname]_[firstname].pdf. The name is entered by the user, and I’m afraid of them entering something with a slash in it. Otherwise, something like $path = $dir.$filename could result in $path = 'uploads/2_smith_john/hahaimajerk.pdf' if the firstname is john/hahaimajerk.

I don’t really want to force users to restrict their names to anything; I don’t mind changing their names a little in the file name as long as I can tell the original name. What characters do I need to escape, or is there some other way to do this? Or…do I just use mysql_real_escape_string?

Answer 1

mysql_real_escape_string won’t escape slashes. Even escapeshellarg won’t do it. You will have to use str_replace:

$path = str_replace('/', '_', $path);