Encoding to Prevent Header Injection

Question

I have a variable $filename that should be considered user input.

I use this $filename in the following:

header(\'Content-Dispo