PHP escape user input for filename
<p>I have a form where users can upload files, and I'd like to name the file something along the lines of <code>[id]_[lastname]_[firstname].pdf</code>. The name is entered by the user, and I'm afraid of them entering something with a slash in it. Otherwise, something like <code>$path = $dir.$filename</code> could result in <code>$path = 'uploads/2_smith_john/hahaimajerk.pdf'</code> if the firstname is <code>john/hahaimajerk</code>.</p>

<p>I don't really want to force users to restrict their names to anything; I don't mind changing their names a little in the file name as long as I can tell the original name. What characters do I need to escape, or is there some other way to do this? Or...do I just use <code>mysql_real_escape_string</code>?</p>
