note 76563 added to features.file-upload

Where does the $_FILES['userfile']['name'] variable come from? Is it generated by the PHP, or is it provided directly from the user? Can I be guaranteed that it does not contain any slashes or ".." or anything like that; so that a malicious user cannot place files in directories other than the one intended? Thanks ---- Server IP: 69.147.83.197 Probable Submitter: 152.75.19.247 ---- Manual Page -- http://www.php.net/manual/en/features.file-upload.php Edit -- https://master.php.net/note/edit/76563 Del: integrated -- https://master.php.net/note/delete/76563/integrated Del: useless -- https://master.php.net/note/delete/76563/useless Del: bad code -- https://master.php.net/note/delete/76563/bad+code Del: spam -- https://master.php.net/note/delete/76563/spam Del: non-english -- https://master.php.net/note/delete/76563/non-english Del: in docs -- https://master.php.net/note/delete/76563/in+docs Del: other reasons-- https://master.php.net/note/delete/76563 Reject -- https://master.php.net/note/reject/76563 Search -- https://master.php.net/manage/user-notes.php