[RESOLVED] Saving Files with Apostrophe's in the Filename

acondiff

I have a file uploader, and when I upload a file with an apostrophe in the filename, it sticks a backslash before the apostrophe like it is trying to escape the apostrophe. How do I get rid of that backslash in the filename?

ie,
I'll Fly.mp3
uploads and becomes
I\'ll Fly.mp3

Here is my code:

		<?php  

			if (array_key_exists('_submit_check', $_POST)) {
				if ((($_FILES["file"]["type"] == "audio/mpeg")) && ($_FILES["file"]["size"] < 50000000)) {
  					if ($_FILES["file"]["error"] > 0) {
    					echo "Return Code: " . $_FILES["file"]["error"] . "<br />";
    				} else {
    					echo "Upload: " . $_FILES["file"]["name"] . "<br />";
    					echo "Type: " . $_FILES["file"]["type"] . "<br />";
    					echo "Size: " . ($_FILES["file"]["size"] / 1024) . " Kb<br />";
    					echo "Temp file: " . $_FILES["file"]["tmp_name"] . "<br />";

					if (file_exists("flash/music/" . $_FILES["file"]["name"])) {
  						echo $_FILES["file"]["name"] . " already exists. ";
  					} else {
  						move_uploaded_file($_FILES["file"]["tmp_name"],
  						"flash/music/" . $_FILES["file"]["name"]);
  						echo "Stored in: " . "flash/music/" . $_FILES["file"]["name"];
  					}
				}
			} else {
				echo "Invalid file";
			}
		}
	?>

sneakyimp

I'm not 100% certain, but I think that your server probably has [man]magic_quotes_gpc[/man] set to "On". If you (or your sysadmin) can edit the PHP.ini file, you should turn this off because it's a complete nuisance.

If you can't, you should call [man]stripslashes[/man] on any GET, POST, or COOKIE values before using them.

acondiff

how would I use stripslashes() in this situation?

would it go something like:

if (((stripslashes($FILES["file"]["type"]) == "audio/mpeg")) && (stripslashes($FILES["file"]["size"]) < 50000000)) {

sorry im not too familiar with this.

Thanks.

sneakyimp

You wouldn't need to do a stripslashes on anything that is sure to be numeric such as $_FILES["file"]["size"] and I also think it's unlikely that you'd need to stripslashes on the mime type either.

It would probably be sufficient to just stripslashes($_FILES["file"]["name"]) whenever you reference it.

Also, if you rely on the $_FILES["file"]["type"] value to tell you what the mime type is, you are depending on the remote user's browser to supply that info. There's nothing preventing a hacker from putting a virus in and telling you it's audo/mpeg.

acondiff

Thank you very much. That worked.