From: "Jonas Roberto de Goes Filho (sysdebug)" <jonas@...>
Date: 2007-09-13T03:14:47+09:00
Subject: Re: secure file writing (escaping characters from the file n

Constantin Gavrilescu wrote:
> Luis Parravicini wrote:
>> On 9/12/07, Constantin Gavrilescu <costi@apluscompuservices.com> wrote:
>>> Any pointers? More importantly about escaping special characters, and
>>> avoiding directory traversal.
>> Hi Constantin,
>>
>> Maybe instead of escaping/removing any character in the filename you
>> can store the file with a unique name and have an index with the user
>> supplied filename and the name of the file in the file system?
> 
> 
> The files are also shared over the network with samba, so they need to 
> have a meaningful name. That's why I need to escape just the "bad 
> characters" and keep most of the other info in.
> 

The unique caracter not acceptable for the filename in unix is /. So, 
why you not replace this caracter '/' to, for example, a blank caracter ''?

-- 
Jonas Roberto de Goes Filho (sysdebug)
http://goes.eti.br