如何上傳前用PHP來獲得安全的文件名

Question

我有一個隨機字符串，散列（MD5/SHA1），uniqid（）或時間戳或更換等文件名.....

示例使用uniqid（）：

9d24707b98e4ddfae9e321ef4f502241.jpg 

例WordPress的sanitiza文件名功能：

function sanitize_file_name($filename) { 
      $filename_raw = $filename; 
      $special_chars = array("?", "[", "]", "/", "\\", "=", "<", ">", ":", ";", ",", "'", "\"", "&", "$", "#", "*", "(", ")", "|", "~", "`", "!", "{", "}", chr(0)); 
      /** 
      * Filter the list of characters to remove from a filename. 
      * 
      * @since 2.8.0 
      * 
      * @param array $special_chars Characters to remove. 
      * @param string $filename_raw Filename as it was passed into sanitize_file_name(). 
      */ 
      $special_chars = apply_filters('sanitize_file_name_chars', $special_chars, $filename_raw); 
      $filename = preg_replace("#\x{00a0}#siu", ' ', $filename); 
      $filename = str_replace($special_chars, '', $filename); 
      $filename = preg_replace('/[\s-]+/', '-', $filename); 
      $filename = trim($filename, '.-_'); 

      // Split the filename into a base and extension[s] 
      $parts = explode('.', $filename); 

     // Return if only one extension 
      if (count($parts) <= 2) { 
        /** 
        * Filter a sanitized filename string. 
        * 
       * @since 2.8.0 
        * 
        * @param string $filename  Sanitized filename. 
       * @param string $filename_raw The filename prior to sanitization. 
        */ 
        return apply_filters('sanitize_file_name', $filename, $filename_raw); 
      } 

      // Process multiple extensions 
      $filename = array_shift($parts); 
      $extension = array_pop($parts); 
      $mimes = get_allowed_mime_types(); 

      /* 
      * Loop over any intermediate extensions. Postfix them with a trailing underscore 
      * if they are a 2 - 5 character long alpha string not in the extension whitelist. 
      */ 
      foreach ((array) $parts as $part) { 
        $filename .= '.' . $part; 

        if (preg_match("/^[a-zA-Z]{2,5}\d?$/", $part)) { 
          $allowed = false; 
          foreach ($mimes as $ext_preg => $mime_match) { 
            $ext_preg = '!^(' . $ext_preg . ')$!i'; 
            if (preg_match($ext_preg, $part)) { 
              $allowed = true; 
              break; 
            } 
          } 
          if (!$allowed) 
            $filename .= '_'; 
        } 
      } 
      $filename .= '.' . $extension; 
      /** This filter is documented in wp-includes/formatting.php */ 
      return apply_filters('sanitize_file_name', $filename, $filename_raw); 
    } 

我的方法是安全/安全的方式還是我需要清理的文件名與任何類/函數或兩者路 組合？

Answer 1

要做的最好的事情是有一個磁盤上的文件名不是由用戶根據任何可預測的數據。您可以簡單地使用資產的ID號作爲其數據庫中的元數據。沒有文件擴展名。不要將它放在Web服務器的文檔根目錄下。