Use realpath() to secure file and path names.