title: Check if string is valid filename
body: <p>I have a question. I got a PHP script (PHP 5) which is saving a URL-Parameter <code>$_GET['file']</code> to the variable <code>$file</code>. Is there now a way to check if this variable is a valid filename (for example: <code>hello.txt</code> and not <code>/../otherdir/secret.txt</code>). Because without checking the $file variable a hacker would be able to use the <code>/../</code> to get to my parent folder.</p>