Question: I have a base path /whatever/foo/

and
`$_GET['path']` should be relative to it.

However how do I accomplish this (reading the directory), without allowing directory traversal?

eg.

```
/\.\.|\.\./

```

Will not filter properly.

Answer: 
Well, one option would be to compare the real paths:

```
$basepath = '/foo/bar/baz/';
$realBase = realpath($basepath);

$userpath = $basepath . $_GET['path'];
$realUserPath = realpath($userpath);

if ($realUserPath === false || strpos($realUserPath, $realBase) !== 0) {
    //Directory Traversal!
} else {
    //Good path!
}

```

Basically, [`realpath()`](http://php.net/manual/en/function.realpath.php) will resolve the provided path to an actual hard physical path (resolving symlinks, `..`, `.`, `/`, `//`, etc)... So if the real user path does not start with the real base path, it is trying to do a traversal. Note that the output of `realpath` will **not** have any "virtual directories" such as `.` or `..`...
I assume you mean without allowing **users** to traverse the directory yes?

If you are trying to stop your own PHP from traversing the directory you should just make the php work properly in the first place.

What you need to stop users is a modified .htaccess file...

```
Options -Indexes

```

(This all assumes you are talking about users)