CI_Security::sanitize_filename()

sanitize_filename($str[, $relative_path = FALSE])

Tries to sanitize filenames in order to prevent directory traversal attempts and other security threats, which is particularly useful for files that were supplied via user input.

$filename = $this->security->sanitize_filename($this->input->post('filename'));

If it is acceptable for the user input to include relative paths, e.g. file/in/some/approved/folder.txt, you can set the second optional parameter, $relative_path to TRUE.

$filename = $this->security->sanitize_filename($this->input->post('filename'), TRUE);