Delete a file with "/"'s in the name

[Snooble]

Hey, I made an upload form in PHP. Uploaded a file with the name "Boys Don't Cry" the filename on my FTP is now "Boys Don/'t Cry". And it won't let me delete or rename it. Error 550?

 

How can i delete it?

 

Snooble

[ratcateme]

are you on a linux or windows server? i didn't/'s (froward slashes) were allowed on windows but:

<?php
unlink("Boys Don/'t Cry");
?>

should remove your file.

i would advise adding something to your upload script to remove all bad chars.

 

Scott.

 

 

[Snooble]

That worked perfectly! Yeah I need to restrict the input! Anyway I can do this? Here's my upload form:

<!-- The data encoding type, enctype, MUST be specified as below -->
<form enctype="multipart/form-data" action="checkupload.php" method="POST">
   <!-- MAX_FILE_SIZE must precede the file input field -->
   <input type="hidden" name="MAX_FILE_SIZE" value="104857600" />
   <!-- Name of input element determines name in $_FILES array -->
   Send this file: <input name="uploaded_file" type="file" />
   <input type="submit" value="Send File" />
</form>

 

Here's the checkupload.php:

 

<?php
//check that we have a file
if((!empty($_FILES["uploaded_file"])) && ($_FILES['uploaded_file']['error'] == 0)) {
  //check if the file is JPEG image and it's size is less than 350Kb
  $name = basename($_FILES['uploaded_file']['name']);
  $filename = str_replace("'","",$name);
  $ext = substr($filename, strrpos($filename, '.') + 1);
  if (($ext == "mp3") && ($_FILES["uploaded_file"]["type"] == "audio/mpeg") && 
    ($_FILES["uploaded_file"]["size"] < 104857600)) {
    //Determine the path to which we want to save this file
      $newname = dirname(__FILE__).'/uploads/'.$filename;
      //Check if the file with the same name is already exists on the server
      if (!file_exists($newname)) {
        //Attempt to move the uploaded file to it's new place
        if ((move_uploaded_file($_FILES['uploaded_file']['tmp_name'],$newname))) {
           echo "It's done! The file has been saved as: ".$newname;
        } else {
           echo "Error: A problem occurred during file upload!";
        }
      } else {
         echo "Error: File ".$filename." already exists".$_FILES['uploaded_file']['name']."";
      }
  } else {
     echo "Error: Only .mp3 songs under 100MB are accepted for upload ".basename($_FILES['uploaded_file']['name'])."";
  }
} else {
echo "Error: No file uploaded";
}
?>

 

Thanks Scott!

 

Snoobs

[ratcateme]

maybe you could change

$filename = str_replace("'","",$name);

to

$filename = str_replace("/","",str_replace("'","",$name));

 

Scott.

 

[Snooble]

if it helps anyone... was a problem with the version of PHP i've got... just downloaded the newest WAMP and it works fine... now i get the full name sent from the upload form. of which i can use str_replace to limit chars.

 

Thanks

 

Snoobs