note 33806 added to security.filesystem

I like to use realpath() to check where the user is. If realpath doesn't start with /home/username/ anymore then i just abort the script user_dir = "/home/" . $username $rp = realpath($user_dir) $rp_substr = substr($rp,0,strlen($user_dir)) if($rp_substr != $user_dir) { exit; } This has up till now worked well for me. If anyone sees a security leak please tell me! ---- Manual Page -- http://www.php.net/manual/en/security.filesystem.php Edit Note -- http://master.php.net/manage/user-notes.php?action=edit+33806 Delete Note -- http://master.php.net/manage/user-notes.php?action=delete+33806&report=yes Reject Note -- http://master.php.net/manage/user-notes.php?action=reject+33806&report=yes