File upload: quotes in filenames

Do you have a question? Post it now! No Registration Necessary.  Now with pictures!

Yet another file upload post!

I've read the annotated manual and googled, but haven't seen
this one.

Uploading using the code given in the manual, if I upload
a file called


then $_FILES['userfile']['name'] gets a value of


Hmm! I know it's unlikely that a file would have a quote in
the name but it's not impossible and it would be good to be
able to handle it.

While working on this application (create/delete/update user
accounts in a database and allow users to upload/download files)
I've found it very difficult to handle text, both in database
records and file names, which might have singlequotes, doublequotes
and HTML entities embedded. I don't know of any company which
has " as part of its name but who knows, there might be one.

This seems to be a limitation of HTML in that quotes are used
for delimiters and it's hard to handle delimited values where
the values might contain either or both types of quote.

Jim Hatfield

Site Timeline