title: Is a regex safe for user supplied filenames - PHP
body: <p>I know the golden rule, never trust user supplied filenames.  I want to break that rule though.  Is there anything unsafe about the following scheme?</p>
  
  <pre><code>   $name = $_POST['name'];
     $id = intval($_GET['id']);
  
     $sanitized_name = preg_replace('/[^0-9a-zA-Z]/','',$name);
  
     $fp = fopen("/path/to/".$id."/".$sanitized_name.".jpg",'w');
  </code></pre>
  
  <p>If I replace everything that is NOT 0-9 or a-z or A-Z with '' then there's absolutely 0% change anyone can inject a '.' to create their own extension (with the combination of a NULL byte) or traverse a directory.  This seems safe.  I just wanted to run it by SO.</p>
  
  <p>Also since the ID is forced to be an int, anything funky will simply turn into a 0.</p>