This is probably too late to help, but:
$folder = strtolower(str_replace(" ", "_", $_POST['folder']));
You should probably replace all non-alphanumeric character, though, because you're going to have a problem accessing a folder with a tab, carriage return, or special character in the name. So, maybe:
$folder = strtolower(preg_replace("/[^A-Za-z0-9_]/g", "_", $_POST['folder']));
I just typed that up for this, so I haven't tested it for errors. Theoretically, it should replace anything other than a letter, number, or underscore with an underscore.