file upload with apostrophe in filename

Hoping for some guidance here if anyone can assist.

I have a form for applications, applicants fill the form, and upload a resume. I also have a backend administration area where human resources can view the applications and make notes on each one.

An unforeseen issue has popped up recently where applicants will upload a resume and include an apostrophe in the file name as in - john doe's resume.pdf -

Somewhere in the process the actual file name gets re-written to john doe\'s resume.pdf and as such the backend admin area can not find the link to that particular file.

As I understand it this addition of the forward slash is a security feature. My question is how can I and where can I alter the code to just have an apostrophe truncated so the file is rewritten as john does resume.pdf with no apostrophe and no forward slash?

cheers

Hi,

I assume you are using Data Assist to insert the file name into a database field?

What binding are you assigning to the field that contains the file name?

Cheers
Ian

Hi the only Binding I have assigned is if file exists [NewFileName]_[Increment]

Funnily enough, I have come across this exact same issue this morning!

I've put some client side validation in place to prevent the file being uploaded if it includes illegal characters.

Cheers
Ian

add the following code at line 1 of the page you have applied the upload to:

<?php

if(sizeof($_FILES) > 0) {

    foreach($_FILES as $k => $v) {

        $_FILES[$k] = str_replace("'", "", $v);

    }

}

?>

Hi Thank you,

That works in rewriting the database file name from johndoe's.pdf to johndoes.pdf but the actual filename is changed to johndoe\s.pdf and stored in the folder as that.

Should I change the bindings in the file manipulation upload wizard File upload from [FileName] to [Server File Name] ?

alright, I think the problem is caused by having the magic_quotes_gpc setting in your php.ini file enabled, this is a deprecated setting and should not be enabled on newer ph installation.

to work around the issue, try changing the code block i gave you earlier to:

<?php

if(sizeof($_FILES) > 0) {

    foreach($_FILES as $k => $v) {

        $_FILES[$k] = str_replace(array("\\","'"), "", $v);

    }

}

?>

Bingo! That did the trick works like a charm

your assistance is greatly appreciated.

Thanks

Kerry

Originally Said By: contact318852

  Hi Thank you,

That works in rewriting the database file name from johndoe's.pdf to johndoes.pdf but the actual filename is changed to johndoe\s.pdf and stored in the folder as that.

Should I change the bindings in the file manipulation upload wizard File upload from [FileName] to [Server File Name] ?  

Yes, you should bind to the Server File Name value for your Data Assist insert.

Cheers
Ian

Ian, in this case, Kerry is talking about the setting in the Upload File behavior for If the File Exists.

Not the binding in the data Assist insert record behavior.

in the insert record behavior, the server file name binding should be used, but do not change the If File Exists setting in the upload file behavior to use [Server File Name]. The If file exists setting is used to determine the server file name, so server file name cannot be used as a part of that setting, it would create circular logic.