just avoid tilde substitution, do not perform sanitizingsanitizing can lead to file name clashes in case the nameswithout tilde exists, and they are OS specific. The intentionof "ad_file" is just to be a tilde-proof "file" replacement
Do not allow backslashes in folders created via zipfile uploadAs the folder name is used also for looking up for existing folders, the safest approach is to block the user: the risk with an automatic sanitization would be to overwrite existing folders without the user realizing