I'm looking for a way to sanitize the filename of user uploaded attachments.

I thought that wordpress already did it but I faced preblems after an user uploaded an attachment containing a '°' . That way the attachment is not downloadable.

I found out this wp function:


is there a way to use it inside the




  • Can you tell the filename in full? Which encoding is your blog using? UTF-8?
    – hakre
    Dec 22, 2010 at 22:12
  • filename: ASSOSTAT-2°-TRIM.-09-10.pptx, and my database is set up with utf8 charset, is it better to remove the utf8 setting on wp-config.php?
    – Dalen
    Dec 22, 2010 at 22:20
  • It looks like a bug to me, those characters are invalid for filenames in URLs aren't they? I've logged it as a bug anyhow: core.trac.wordpress.org/ticket/15955
    – t31os
    Dec 22, 2010 at 22:31
  • @t31os: is it the case of adding the '°' character to the $special_chars array you mentioned on the bug's ticket?
    – Dalen
    Dec 22, 2010 at 22:55
  • I'll wrap some info into answer, the comments area isn't suitable to cover it...
    – t31os
    Dec 22, 2010 at 23:07

2 Answers 2


Following on from question comments.

You can run a filter on sanitize_file_name_chars and add the degree symbol to the array of invalid chars, but it won't halt the upload it will simply strip the file extension.

However you can add another filter stop the upload, in a hacky kind of way by additionally hooking on the sanitize_file_name filter which occurs shortly after the one above, there you see if a file extension is present, if not you know there was a hit in the invalid chars array and you can die() inside the filter, which will cause the upload process to return a HTTP error(which is better then just silently dieing i guess).

add_filter( 'sanitize_file_name_chars', 'restrict_filename_chars' );

function restrict_filename_chars( $special_chars ) {
    $special_chars = array_merge( array( '°' ), $special_chars );
    return $special_chars;

add_filter( 'sanitize_file_name', 'die_on_no_ext' );

function die_on_no_ext( $filename ) {
    global $parts;
    if( $parts < 2 )
    return $filename;

It's not an ideal solution mind you, and we'll see what happens with the ticket(i might just be missing something, i'm no expert on file validation).

NOTE: The filter only ensures the actual file name does not contain the degree symbol, not the "post name" (ie. the title of the attachment), you'll need another filter to deal with sanitizing the attachments title, as this is handled by different functions and filters.

  • this seems a good patch, i need will try it later on today. thanks
    – Dalen
    Dec 23, 2010 at 7:33
  • I don't think it's ideal, WP should be stopping invalid files from being processed, and it's exactly why i've raised a ticket, what good is an invalid chars array if hitting a match only strips off the file extension but let's the file through.
    – t31os
    Dec 23, 2010 at 10:46
  • i tested it but it is not working as epexpetced, at least the 1s filter. Nothing is changing on the filename, i tried also to add "°" directly to the $special_chars on wp-includes/formatting but nothing. The second filters seems to block too much, also valid filename attachments can't pass through it
    – Dalen
    Dec 23, 2010 at 23:40
  • I didn't test thoroughly, but i'm still sure there's a bug with that function and it's filters anyway, it should be doing more to sanitize strange character entities. I'll write a better workaround than the above when i get some more time to test.
    – t31os
    Dec 27, 2010 at 12:51
  • ok, i'm trying to do the same, thanks again and happy holidays
    – Dalen
    Dec 27, 2010 at 17:10

Look how I did it in my plugin Germanix URL. I hook into 'sanitize_file_name', convert what I need and strip anything else. This way, the file gets through, but the filename is valid.

I think this is the best possible user experience: No data is lost and no time, and no irritating error message pops up.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.