ereg_replace problems

influx

Hi all,

I have an upload feature on my website that allows users to upload files to their blogs online.

In order to store the files on the server, I need to change some filenames (i.e: if they have symbols in them, etc.)...so I use the following code to strip the filename of characters:

$file_name = ereg_replace('[ ]+', '_', strtolower($file_name)); //replace spaces with underscores
$file_name = ereg_replace('[^a-zA-Z0-9 \. \_]', '', $file_name); //no characters allowed except periods and underscores

Now, I have a problem with this:

I uploaded file: 'hello_my_name's.doc' to test, and it came out like: 'hello_my_name\s.doc'. Shouldn't the second line strip the filename of apostrophes too? How can I fix this?

thanks.
-influx

laserlight

Include the underscore in the list of allowed characters (and remove the space). Conversely, you could swap the order.

influx

swapping the order would get rid of spaces...how could I fix the second problem?

laserlight

swapping the order would get rid of spaces

It wouldnt - you allow spaces.

how could I fix the second problem?

I dont see why the second problem should exist. You're probably doing something wrong elsewhere.

laserlight

Oh, I know why you still have the slash problem. You have magic_quotes_gpc set to on, and your pattern allows backslashes.

I would use:

$file_name = preg_replace('/\s+/', '_', strtolower($file_name));
$file_name = preg_replace('/[^\w\.]/', '', $file_name);

influx

I don't see where the problem could be.

Here is how I store $file_name...I store it in the database and as a file with the same name, same variable.

$file_name = ereg_replace('[ ]+', '_', strtolower($file_name)); //replace spaces with underscores
$file_name = ereg_replace('[^a-zA-Z0-9 \. \_]', '', $file_name); //no characters allowed except periods and underscores 

move_uploaded_file($_FILES['userfile']['tmp_name'], "/user_upload/".$file_name); //store uploaded file on server

$query = "UPDATE upload SET u_file1_name = '".$file_name."' WHERE username = '".$_SESSION['username']."'"; //store NAME of file in database

That's odd.