%FILENAME% not sanatized properly