The sanitize_name() function strips out the / characters in the path, so the files end up in the web root folder. Also, the code which was there before creates really, really long filenames, which may be too long on some file systems, so something like this might fix both problems: $filename = md5(SDATA_DB_SALT.var_export($dataPoints, true).var_export($graphOptions, true)).".png";