Upload files and special characters problem

[xamonix]

Hi,

I've got a script to upload images by users. What happens is users usually put special characters on filename like "ç" and "ã". When they do so the filename on server gets weird like this "canóú.jpg". I would like to have some help on this script to remove this special charactres from filename on upload.

Here is the script I got:

//Send Images

$userfile2=(isset($_FILES['userfile']['tmp_name']) ? $_FILES['userfile']['tmp_name'] : "");
$userfile_name=(isset($_FILES['userfile']['name']) ? $_FILES['userfile']['name'] : "");
$imagesize = $_FILES['userfile']['size'];

if (( $imageenabled == 2 ) || ( ($imageenabled == 1) && (!empty($userfile_name)) ) ) {
$base_Dir = ELPATH.'/images/eventlist/events/';
$sizelimit = $sizelimit*1024; //size limit in kb

if ($imagesize > $sizelimit) {
mosRedirect("index.php?option=$option&Itemid=$Itemid", "Image too big"." ");
}

if (!move_uploaded_file ($_FILES['userfile']['tmp_name'],$base_Dir.$_FILES['userfile']['name']) || !mosChmod($base_Dir.$_FILES['userfile']['name'])) {
mosRedirect("index.php?option=$option&Itemid=$Itemid", _EVENTS_IMAGEFAIL." ");
} else {
$file = $base_Dir.$userfile_name;
//chmod Bild
@chmod ($file, octdec($imagechmod));
//Vorbereiten auf Thumbnailerstellung
$thumbdir = $base_Dir.'small/';
$save = $thumbdir.$userfile_name ;
if ($imageprob = 1) {
$imageprob = TRUE;
} else {
$imageprob = FALSE;
}
if ($gddisabled == 1) {
evlist_imgd::thumb($file, $save, $imagewidth, $imagehight, $imageprob);
}
}
$_POST['datimage'] = $userfile_name ;
}

 

Thank you for your time!

[smerny]

something like this would strip everything except letters and numbers... but this means if your user submits a word with non-standard letters, it might change the meaning of the word or something, not sure if this matters? if it does, you should just warn the user, telling them to enter a new name and not use those characters.

 

$userfile_name = preg_replace("/[^a-zA-Z0-9]/", "", $userfile_name);

[xamonix]

Thank you for your answer, but this line should go where?

After or before this piece of code?

$userfile2=(isset($_FILES['userfile']['tmp_name']) ? $_FILES['userfile']['tmp_name'] : "");
$userfile_name=(isset($_FILES['userfile']['name']) ? $_FILES['userfile']['name'] : "");

[smerny]

could put it right after initializing $userfile_name