At this point we can upload a file restricting its size and type and if successful the file is saved
with its original file name in the uploads folder.
Although we've restricted the type and size of the file We're still accepting the original file name
without changing it.
This is a potential security hole.
Someone could upload a file with a name that contains invalid characters are even a name that allows
them to move the file to somewhere else in the file system.
So before we move the file let's sanitize the file name only allowing certain characters.
First we need to get the name part of the file name not including the file extension at the end.
We can use this using the path info function which splits the file name up into its various parts.
The name the extension and so on.
So let's call this function passing in the file name from the files array.
This returns an array.
The base name of the file which is the file name without the extension on the end is in the file name
element.
Then we can use the Prag replace function to replace any characters we don't want to allow with another
one.
The first argument to the prog replace function is a regular expression.
This is basically a pattern of characters the function looks far in the string.
This regular expression matches any character that isn't a lower case A to Z uppercase A to Z numbers
from not to 9 underscores and hyphens.
If the function finds one of these characters it replaces it with the second argument to the function
which we'll put as an underscore character.
The final argument is the string we want to change.
Then we can create the file name by adding a dot R period to the base and adding the original file names
extension.
Finally we can create the full destination path by adding the uploads folder.
Let's give that a try.
Here's a file that contains several odd characters but it is a valid image and it doesn't exceed the
size limit.
When we submit the farm it is uploaded successfully.
But the file has been renamed to remove the characters.
We didn't allow.