Thanks Kenneth,

        This helped me narrow down the problem, turns out UrlScan was active at the site level and was blocking the brackets as part of its SQL Injection rule.  A quick whitelist of the uploader pages and it was fine.

Steven J