[cyphar]

Never use filenames in a database. There's a bottomless well of security vulnerabilities that spring forth when you decide to "just store a path to the asset".

[unlinker]

Of course, you don't take for granted what the client says. You generate your own file name.