I was reading "The Tangled Web"(A book that I'm enjoying very much) and I have a doubt in the following excerpt taken from it :-
When Handling User-Controlled Filenames in Content-Disposition Headers If you do not need non-Latin characters: Strip or substitute any characters except for alpha- numerics, “.”, “-”, and “_”. To protect your users against potentially harmful or deceptive filenames, you may also want to confirm that at least the first character is alphanumeric and substitute all but the rightmost period with something else (e.g., an underscore). Keep in mind that allowing quotes, semicolons, backslashes, and control characters (0x00–0x1F) will introduce vulnerabilities. If you need non-Latin names: You must use RFC 2047, RFC 2231, or URL-style percent encoding in a browser-dependent manner. Make sure to filter out control characters (0x00–0x1F) and escape any semicolons, backslashes, and quotes.
- Which are the characters meant to be URL percent encoded?
- By "escaping semicolons, backslashes, and quotes", is escaping using backslashes meant?