xml output keeps breaking because of user named files...

[dumbass]

Hmm, I'm trying to output xml using dynamically generated tags from a database, etc.

Some of the tags need to be populated with file names/paths. Users are uploading files, but they're using crazy characters that are breaking the xml output and leaving an incomplete malformed xml document. Mahhh!

How to others handle this? Do you rename your uploaded files to a uniq ID? Or is there a way to strip file names of all non alpha-numeric characters or escape quotes, etc?

I tried this:

private function cleansFileName($fileName)
{
	$replace="_";
	$pattern="/([[:alnum:]_\.-]*)/";
        $fileName=str_replace(str_split(preg_replace($pattern,$replace,$fileName)),$replace,$fileName);

return $fileName;
}

But that didn't seem to help much.

Any advice? Thanks!

[NogDog]

I normally rename uploaded files using some arbitrary numbering/ID scheme. If I'm storing data about it in a DB, the first I'd do the DB insert, grab the auto-insert ID, and use that as part of the file name, perhaps along with the user's ID and/or a date/time value. (You might then have to update the inserted record with that file name.)