string sanitizer for filename

Question

I'm looking for a php function that will sanitize a string and make it ready to use for a filename. Anyone know of a handy one?

( I could write one, but I'm worried that I'll overlook a character! )

Edit: for saving files on a Windows NTFS filesystem.

Answer 1

The following expression creates a nice, clean, and usable string:

/[^a-z0-9\._-]+/gi

Turning today's financial: billing into today-s-financial-billing

Answer 2

preg_replace("[^\w\s\d\.\-_~,;:\[\]\(\]]", '', $file)

Add/remove more valid characters depending on what is allowed for your system.

Alternatively you can try to create the file and then return an error if it's bad.

Answer 3

Instead of worrying about overlooking characters - how about using a whitelist of character you are happy to be used? For example, you could allow just good ol' a-z, 0-9, _, and a single instance of a period (.). That's obviously more limiting than most filesystems, but should keep you safe.

Answer 4

Well, tempnam() will do it for you.

http://us2.php.net/manual/en/function.tempnam.php

but that creates an entirely new name.

To sanitize an existing string just restrict what your users can enter and make it letters, numbers, period, hyphen and underscore then sanitize with a simple regex.

$sanitized = preg_replace('/[^a-zA-Z0-9-_\.]/','', $filename);

Answer 5

/ and .. in the user provided file name can be harmful. So you should get rid of these by something like:

$fname = str_replace('/','',$fname);
$fname = str_replace('..','',$fname);

Answer 6

Making a small adjustment to Tor Valamo's solution to fix the problem noticed by Dominic Rodger, you could use:

preg_replace("[^\w\s\d\-_~,;:\[\]\(\]]|[\.]{2,}", '', $file)

Answer 7

You could always find out what characters in file names are not allowed by naming a file in explorer and pressing an invalid character it will pop up with a message like "A filename cannot contain any of the following characters: ..."

Answer 8

one way

$bad='/[\/:*?"<>|]/';
$string = 'fi?le*';

function sanitize($str,$pat)
{
    return preg_replace($pat,"",$str);

}
echo sanitize($string,$bad);