Using basename() is not locale safe

Non-US-ASCII characters are stripped out of uploaded filenames. PHP's basename() does not properly support streams or filenames beginning with international characters.