phprealpath()返回一个空白字符串


php realpath() returns a blank string

在这篇文章的指导下,防止PHP中的目录遍历但允许路径我试图阻止目录遍历,但我遇到了一些奇怪的事情,在第一个例子中,realpath返回了一个好的路径

        $fPath = $path.$parent.'/'.$name;
//$name (the user input) in this sample is "fff", $parent is an empty string        
        //make sure user didn't try to traverse backwards on the basepath           
        $basepath = $path;
        $realBase = realpath($basepath);
echo $realBase."<br/>";
//gives: /Users/me/Documents/www/gallery/php_sample/uploadedImages
        $userpath = $fPath;
echo $userpath."<br/>";
//gives: /Users/me/Documents/www/gallery/php_sample/uploadedImages/fff
        $realUserPath = realpath($userpath);
echo $realUserPath."<br/>";
//gives blank (an empty string).

为什么?

就像AbraCadaver在评论中所说的,"只有当目录存在时,这才有效。要验证/消毒用户提供的目录,您需要一些规则,并对其进行清理或拒绝。"