title: How to sanitize $_GET variables to prevent path injection?
body: <p>What is the best way to sanitize <code>$_GET['']</code> request? I want to allow downloading files from one directory only.  </p>
  
  <pre><code>$baseDir = "/home/html/xy.com/public_html/downloads/";    
  $path = realpath($baseDir . $_GET['file']);  
  </code></pre>
  
  <p>What is the next step?</p>