I have a cgi script that writes files on the filesystem. The files are
provided by the users. I need to save them with (almost) the same name
as the user requests. What characters I need to escape?
This is on linux. Right now the file: “Mick J. / Chris Jagger -
Racketeer Blues” does not get saved because of the “/” character. I
don’t escape any characters now. I want to keep as many of the original
characters in the file name as I can. For the characters that cannot be
escaped, I suppose I need a translation table… to figure out what was
the original filename.
Any pointers? More importantly about escaping special characters, and
avoiding directory traversal.