filename escaping for upload: fixed