Protecting from LFI-like vulnerabilities when the file doesn't exist yet
===

If a user was requesting a file on a service, I could normally protect them from accessing documents outside the scope of what I want by using PHP's [realpath()][1] and ensuring it is under the root directory. Such as like this:

    $path = realpath($_GET['path']);
    // Protect against LFI vulnerabilities
    if (substr($path, 0, strlen($root)) == $root)
    {
        // safe
    }

However, realpath() only works on files *that already exist*.
What if I want to ensure that the location the user is about to have my script write to is under the root?

I can't use realpath(), should I just check and strip out '..' references? 
Or is there a better way?


  [1]: http://php.net/manual/en/function.realpath.php