    public static function fixName($name) {
        $name = preg_replace('/[^A-Za-z0-9\.]/','_',$name);
        if ($name[0] == '.')  // attempt to upload a dot file
            $name[0] = '_';
        $name = str_replace('_', '..', $name);  // attempt to upload with redirection to new folder
        return $name;
//        return preg_replace('/[^A-Za-z0-9\.]/', '-', $name);
    }
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.