removing directory traversal security threat

[dmmh]

somehow this will still output any files specified to get via the 2 $_GET variables, allowing people to actaully access all my files using directory traversal, which needless to say isnt a pretty thing. Can't find the error :(

$name = $_GET['name'];
$id = $_GET['id'];
$banned = array("../","./","..\\",".\\");

foreach($banned as $str){
if(strpos($id, $str!== false) ¦¦ strpos($name, $str!== false)){
die("sod off hacking #*$!");
}else{
$url = "../../images/tmp/$id/$name";
etc
etc
}
}

[dhardisty]

try using the absolute file location -- for example, use $_SERVER['DOCUMENT_ROOT']."/images/tmp/$id/$name" instead of "../../images/tmp/$id/$name"

I don't know if it will succeed in preventing the hacks, but it's worth a shot.