From that point of view you shouldn't use a computer at all. That said, I am not a person who don't cares about security.
I agree, replacing ":" my be not enough, you also have to replace ".." and some other tiny bits. But with a hand full of lines of code it will be pretty save. Probably saver than the NASA computers.
URL Encoding is decoded prior the script will use it, so "%3A" will be ":" when you start filtering. I don't know how malformed UTF-8 chars could be a problem since the relevant characters are inside the ASCII subset that is not affected by UTF-8, all that happens is php will try to find a file with a given name. If it cannot be found, nothing's gonna happen, but a "cannot include" php warning.
Correct me if I'm wrong and please elaborate in detail.
I agree, replacing ":" my be not enough, you also have to replace ".." and some other tiny bits. But with a hand full of lines of code it will be pretty save. Probably saver than the NASA computers.
URL Encoding is decoded prior the script will use it, so "%3A" will be ":" when you start filtering. I don't know how malformed UTF-8 chars could be a problem since the relevant characters are inside the ASCII subset that is not affected by UTF-8, all that happens is php will try to find a file with a given name. If it cannot be found, nothing's gonna happen, but a "cannot include" php warning.
Correct me if I'm wrong and please elaborate in detail.