Question: I have a base path /whatever/foo/

and
`$_GET['path']` should be relative to it.

However how do I accomplish this (reading the directory), without allowing directory traversal?

eg.

```
/\.\.|\.\./

```

Will not filter properly.

Answer: 
Well, one option would be to compare the real paths:

```
$basepath = '/foo/bar/baz/';
$realBase = realpath($basepath);

$userpath = $basepath . $_GET['path'];
$realUserPath = realpath($userpath);

if ($realUserPath === false || strpos($realUserPath, $realBase) !== 0) {
    //Directory Traversal!
} else {
    //Good path!
}

```

Basically, [`realpath()`](http://php.net/manual/en/function.realpath.php) will resolve the provided path to an actual hard physical path (resolving symlinks, `..`, `.`, `/`, `//`, etc)... So if the real user path does not start with the real base path, it is trying to do a traversal. Note that the output of `realpath` will **not** have any "virtual directories" such as `.` or `..`...
1
=

put a null index.htm for -Index block

2
=

filter sQS on start

```
// Path Traversal Attack
if( strpos($_SERVER["QUERY_STRING"], "../") ){
    exit("P.T.A. B-(");
}

```