title: What is the security issue with my code?
body: <p>A few years ago, I posted <a href="https://stackoverflow.com/a/4205182/240613">an answer</a> to a question about a way, in PHP, to let the user pass in the URI the relative path to the file to download, while preventing directory traversal.</p>
  
  <p>I got a few comments telling that the code is insecure, and a few downvotes (the most recent being today). Here's the code:</p>
  
  <pre><code>$path = $_GET['path'];
  if (strpos($path, '../') !== false ||
      strpos($path, "..\\") !== false ||
      strpos($path, '/..') !== false ||
      strpos($path, '\..') !== false)
  {
      // Strange things happening.
  }
  else
  {
      // The request is probably safe.
      if (file_exists(dirname(__FILE__) . DIRECTORY_SEPARATOR . $path))
      {
          // Send the file.
      }
      else
      {
          // Handle the case where the file doesn't exist.
      }
  }
  </code></pre>
  
  <p>I reviewed the code again and again, tested it, and still can't understand what's the security issue it introduces.</p>
  
  <p>The only hint I got in the comments is that <code>../</code> can be replaced by <code>%2e%2e%2f</code>. This is not an issue, since PHP will automatically transform it into <code>../</code>.</p>
  
  <p>What is the problem with this piece of code? What could be the value of the input which would allow directory traversal or break something in some way?</p>