So, if you are sure that your users won't put any funny characters in their filenames, just remove the caret character from the regex in your code. Different browsers set differen names for uploaded files, but all of them include the base name. If i'm not mistaken, [\w-.] cannot be a path separator on any system.