I have a variable $filename that should be considered user input.
I use this $filename in the following:
header('Content-Disposition: inline; filename="' . $filename . '"');
How would one need to encode this to render $filename safe even when containing a payload?
Edit: From what I have been able to find so far, and what is provided by OWASP here, I may just need to filter all newline and form-feed characters? Looking for confirmation or additional info. Those being the only requirements, the following should be sufficient:
preg_replace('/[\f\r\n]/', '', $filename);
Edit: For this question assume validation has already been performed but a payload has made it through this without being rejected.