title: Do I need to filter the $_FILES['file'] before dealing with it?
body: <p>To protect the websites we're programming from attacks such as SQL-Injection or XSS we need to filter users' inputs before storing or displaying it.</p>
  <p>In PHP, we use <code>htmlspecialchars</code> and <code>addslashes</code> functions to the inputs to prevent XSS and SQL-Injection attacks. So, what about the files ?</p>
  <p>I used to protect web-apps by checking the files type and it's extension to know if those were in the whitelist or not. But I don't use <code>htmlspecialchars</code> and <code>addslashes</code> functions because I didn't see someone using this approach.</p>
  <p>For example, if I want to get the file name I use <code>$_FILES['file']['tmp_name']</code> then I store it directly to the database.</p>
  <p>Is this wrong or it cannot be injected with codes, commands ... etc.</p>