If this doesn´t work (I´m not sure if one can asign new values to server side variables), then this should work:
In
addpost.php
find:
$FileName = "$Mnumber-{$HTTP_POST_FILES['userfile']['name']}";
Replace with:
$uploadname = $HTTP_POST_FILES['userfile']['name'];
$uploadname = str_replace(" ", "_", $uploadname);
$uploadname = preg_replace('([^_a-zA-Z0-9\-\.])', '', $uploadname);
$FileName = "$Mnumber-$uploadname";