Question: I have a website that allows users to upload a file. when uploading the file on another page users can download that file. the problem is if the file name has a space in it will only pick up the first work not the whole file name. i was wondering is there a way to download the file with spaces in it or an easy option might be to add underscores to the file name so that it can be downloaded. 

```
 //This is the directory where images will be saved 
 $target = "../images/avatars/"; 
 $target = $target . basename($_FILES['photoLocation']['name']);

// Check to see all fields have been completed
$photoLocation =($_FILES['photoLocation']['name']);

if (!empty($photoLocation))
{

    // Create an SQL query to add the comment
    $sql = "INSERT INTO tblPhotoUpload (photoLocation) VALUES ('$photoLocation')";

    // Connect to the database
    connect();

    // Run the query and store the result in a variable
    $result = mysql_query($sql) or die("Could not run query");

    //Writes the photo to the server 
    if(move_uploaded_file($_FILES['photoLocation']['tmp_name'], $target))

    // Close connection to the database
    mysql_close()

```

And i am displaying the file like this. 

```
while($record = mysql_fetch_array( $result )) 
 { 
 ?> 

 <tr class="row">
    <td class="cell"><a href= http://xxxxxxxxxxxxxxxxxxxxxx.com/images/avatars/<?php         echo $record["photoLocation"];?>>Download</a> </td>

```

Answer: 
You're dealing with an escaping scheme within an escaping scheme when you work with URLs. In particular, you have to escape the URL so as to be a URL, and then you have to escape the URL as to embed it in HTML:

```
$url = "http://somesite.tld/some/path/" . urlencode($filename);

echo '<a href="' . htmlspecialchars($url) . '">link</a>';

```

It's pretty damn hard to think of a (realistic) situation that actually requires htmlspecialchars, but wooo paranoia!

Oh, and also, it's typically a good idea to just go ahead and quote all of your attribute values.

When you do: `<tag attr=value with spaces>` browsers interpret `with` and `spaces` as additional attributes, notas part of the value for `attr`

---

If you do go the replacement route though, you're just looking for a simple str\_replace call:

```
$val = str_replace(' ', '_', $replaceMe);

```
Haven't tested but this logic seems right.

```
$name = str_replace(' ', '_', $photoLocation);

```