note 64087 added to features.file-upload

I have the same problem with filename contains single quote. Currently, I am using web-hosting services, hence I am not able to switch magic_quotes_gpc on/off. After some study, I have discovered that the cause of the problem is in function basename(); For example: $windows_filename = "C:\tmpdir\ling's document.doc" with magic_quotes_gpc on it becames $windows_filename = "C:\\tmpdir\\ling\'s document.doc" if you do a echo basename($windows_filename) the result will be "s document.doc" which is not correct, but this is exactly what we get from $_FILES['userfile']['name']; To work around with this problem, the following solution might work. Step 1: a) Include a hidden field "userfilename" in your form. b) add a javascript to the "file" input. To objective is to dupilcate the full filename and post it to the host. <form name="imgform" method="post" action="upload.php" enctype="multipart/form-data"> <input type="hidden" name="userfilename" id="userfilename"> <input type="file" name="userfile" id="userfile" size="64" maxlength="256" onChange="javascript:top.document.imgform.userfilename.value= top.imgform.userfile.value"> </form> Step 2: a) extract the filename from the "userfilename" $fileName = $_FILES['userfile']['name']; $tmpName = $_FILES['userfile']['tmp_name']; $fileSize = $_FILES['userfile']['size']; $fileType = $_FILES['userfile']['type']; $fp = fopen($tmpName, 'r'); $content = fread($fp, $fileSize); $content = addslashes($content); fclose($fp); if(!get_magic_quotes_gpc()) { $fileName = addslashes($fileName); } else { $fileName = addslashes(basename(stripslashes($_POST['userfilename']))); } ---- Server IP: 203.81.37.58 Probable Submitter: 219.74.21.208 ---- X-Spam-Status: No, hits=4.0 required=5.0 tests=DATE_MISSING,FROM_NO_LOWER, HTML_20_30,HTML_MESSAGE autolearn=no version=2.64 ---- Manual Page -- http://www.php.net/manual/en/features.file-upload.php Edit -- http://master.php.net/note/edit/64087 Del: integrated -- http://master.php.net/note/delete/64087/integrated Del: useless -- http://master.php.net/note/delete/64087/useless Del: bad code -- http://master.php.net/note/delete/64087/bad+code Del: spam -- http://master.php.net/note/delete/64087/spam Del: non-english -- http://master.php.net/note/delete/64087/non-english Del: in docs -- http://master.php.net/note/delete/64087/in+docs Del: other reasons-- http://master.php.net/note/delete/64087 Reject -- http://master.php.net/note/reject/64087 Search -- http://master.php.net/manage/user-notes.php