I have a form where users can upload files, and I'd like to name the file something along the lines of [id]_[lastname]_[firstname].pdf
. The name is entered by the user, and I'm afraid of them entering something with a slash in it. Otherwise, something like $path = $dir.$filename
could result in $path = 'uploads/2_smith_john/hahaimajerk.pdf'
if the firstname is john/hahaimajerk
.
I don't really want to force users to restrict their names to anything; I don't mind changing their names a little in the file name as long as I can tell the original name. What characters do I need to escape, or is there some other way to do this? Or...do I just use mysql_real_escape_string
?