The url would be something like this:
www.example.com/index.php?file=myFile.ext
The filtering would only allow leters and numbers in the file, and only one dot.
The filtering would not give characters from the input to the file functions, instead, on for every allowed character it matches in an internal array, it copies the character from the internal array, and not the character from the input.
Ex:
if( isset(MyArray[inputChar]))
$fileName .= MyArray[inputChar]
This is especially to protect against weird encoding bugs, php bugs etc
The full example bellow (I used array_search() instead of isset()):
//split it to array of chars
$imputCharacters = str_split($_GET["file"]);
//splits it to array like this: [0] => 'a', [1] => 'b', etc
$allowedCharacters = str_split('1234567890abcdefghijklmnopqrstuvwxyz.ABCDEFGHIJKLMNOPQRSTUVWXYZ');
$file = '';
$dots = 0;
foreach ($imputCharacters as $char)
{
$indexKey = array_search($char, $allowedCharacters, true);
if($indexKey === false)
{
die(__FILE__ . __LINE__); // disalowed character
}
else
{
if ($allowedCharacters[$indexKey] === '.') {
$dots++;
if($dots > 1) {
die(__FILE__ . __LINE__); //only one dot allowed
}
}
$file .= $allowedCharacters[$indexKey];
}
}