Properly escaping bad characters from filename in a PHP download -

i have php script downloads files folder off document root. here is:

$getdir = $_get['dir']; $getdoctype = $_get['doctype']; $getfile = $_get['filename']; if ( !preg_match('/^[a-za-z]+[a-za-z0-9\s\_\-]+$/', urldecode($getdir)) ||      !preg_match('/^[a-za-z]+[a-za-z0-9\s\_\-]+$/', urldecode($getdoctype))) {     die('bad parameter!'); } $dir = "/var/www/uploads/$getdir/$getdoctype/";  $type = mime_content_type( $dir . $getfile ); if (file_exists($dir . $getfile)) { header('content-type: ' . $type); header('content-disposition: attachment;filename=' . $getfile); readfile($dir . $getfile); } else{ echo "file not found"; } 

the problem alot of time files uploaded website have invalid characters + # % () alot of these characters ok locally on web interpreted else. using existing script how achieve escaping these characters download works?

you can around having special chars in file downloads wrapping filename in quotes

header('content-disposition: attachment;filename="' . $getfile . '"'); 

alternatively regex remove special chars, although not best option.

something it: regular expression alphanumeric , underscores

to in regex use

$filteredname = preg_replace('/[^a-z0-9\.]/i', '', $filename);