Safe file name check that allows '.' and ' ' and '_'
Bint
I have a PHP script that receives a string and tries to create a filename
from it. I was getting errors when some people were trying to use names
with '&' and certain other characters. I looked online and found some ways
to screen out 'bad' characters. This is what I have been using, along with
some versions I didn't like as much:
if (!preg_match('/^[a-z0-9]+([\\s]{1}[a-z0-9]|[a-z0-9])+$/i',
$filename)) {
// if (!preg_match('/^\w+\.\w+$/', $filename))
// if (!preg_match('/^\w+$/', $ filename)) {
// if (!preg_match(�/[^\w\.]/�, $ filename)) {
I don't really understand what these statements are doing, so I don't know
how to modify them for what I want. Can anyone help?
The top one there does allow spaces, which the bottom three did not, from
what I remember. However, I don't think the top one allows '.' or even '_',
which I would like to allow. I really just want to eliminate characters
that are going to cause an error -- and before I installed this check, '.'
and '_' seemed to be fine.
How should I change that check line? Or maybe I should just try to create
the file and then report an invalid filename if I get an error when I try to
make the file?
Thanks
B
J.O. Aho
> Hi,
>
> I have a PHP script that receives a string and tries to create a filename
> from it. I was getting errors when some people were trying to use names
> with '&' and certain other characters. I looked online and found some ways
> to screen out 'bad' characters. This is what I have been using, along with
> some versions I didn't like as much:
>
> if (!preg_match('/^[a-z0-9]+([\\s]{1}[a-z0-9]|[a-z0-9])+$/i',
> $filename)) {
>
> // if (!preg_match('/^\w+\.\w+$/', $filename))
> // if (!preg_match('/^\w+$/', $ filename)) {
>
> I don't really understand what these statements are doing, so I don't know
> how to modify them for what I want. Can anyone help?
>
> The top one there does allow spaces, which the bottom three did not, from
> what I remember. However, I don't think the top one allows '.' or even '_',
> which I would like to allow. I really just want to eliminate characters
> that are going to cause an error -- and before I installed this check, '.'
> and '_' seemed to be fine.
>
> How should I change that check line? Or maybe I should just try to create
> the file and then report an invalid filename if I get an error when I try to
> make the file?
if (!preg_match('/^[a-zA-Z0-9\.\_][a-zA-Z0-9\.\ \_]+$/i', $filename)) {
//tell user to pick another file name
}
by the way, & is an allowed character in all file systems I know, you can
check what characters are allowed in the file system you are using by visiting
the following page: http://en.wikipedia.org/wiki/Filename
The example here don't allow file names to begin with a space, as it's not
visible.
--
//Aho
Bint
On 5/17/10 12:12 PM, in article 85dbnt...@mid.individual.net, "J.O. Aho"
<us...@example.net> wrote:
Thanks! What about apostrophes ' ? Are they legal? I would like to allow
them. How would I change the preg_match call to allow them?
As far as & , all I know is that saving a file with it in the name caused
the script to fail. Maybe that wasn't a filename thing but some kind of PHP
script thing?
B
J.O. Aho
You have to add those in between the [], this is a character you should
escape, escaping is done with \, so add \' (if you want to add \, then type \\).
> As far as & , all I know is that saving a file with it in the name caused
> the script to fail. Maybe that wasn't a filename thing but some kind of PHP
> script thing?
Say in Linux you hav to escape the &, so when you save you may need to write
it as \& or else it may be intrepid as "run in the background"
--
//Aho
Bint
On 5/17/10 1:44 PM, in article 85dh3r...@mid.individual.net, "J.O. Aho"
<us...@example.net> wrote:
Thanks again,
I tried this:
if (!preg_match('/^[a-zA-Z0-9\.\_][a-zA-Z0-9\.\ \_\']+$/i', $filename))
{
But the test fails if I include a ' character. Is what I have above wrong?
I added a \' at the end of that second [].
B
Raymond Schmit
wrote:
>if (!preg_match('/^[a-zA-Z0-9\.\_][a-zA-Z0-9\.\ \_]+$/i', $filename)) {
> //tell user to pick another file name
>}
>
>by the way, & is an allowed character in all file systems I know, you can
>check what characters are allowed in the file system you are using by visiting
>the following page: http://en.wikipedia.org/wiki/Filename
>
>The example here don't allow file names to begin with a space, as it's not
>visible.
I think that file names may not end with a space ...
J.O. Aho
Could it be you tried to have ' as the first character in the file name? In
that case you would get a false, the first [] is the allowed starting
characters for the file name, while the second [] is for the rest of the
characters in the file name.
--
//Aho
matt
> On Mon, 17 May 2010 19:12:29 +0200, "J.O. Aho" <u...@example.net>
You could certainly simplify the regex by combining it with a trim()
$filename = trim($filename);
if (preg_match("/[^\w\d\._' ]/", $filename)) { }
btw, \w = locale-sensitive "word" characters (can't remember off the
top of my head if this usually includes spaces and underscores...), \d
= digits