 <p>one of the easier ways is to harden your <code>php.ini</code> config, specifically the <a href="http://www.kavoir.com/2009/06/php-open_basedir-in-phpini-to-limit-php-file-accesses-to-a-certain-directory.html" rel="nofollow noreferrer">open_basedir directive</a>. Keep in mind, some CMS systems do actually use <code>..\</code> quite a bit in the code, and when there are includes outside the root folder this can create problems. (i.e. pear modules)</p> <p>Another method is to use <a href="http://www.ice2o.com/secure_php.php" rel="nofollow noreferrer">mod_rewrite</a>.</p> <p>Unless you are using an include file to check each and every URL for injection from <code>$_GET</code> and <code>$_SERVER['request_uri']</code> variables, you will open doors for this kind of attack. for example, you might protect <code>index.php</code> but not <code>submit.php</code>. This is why hardening <code>php.ini</code> and <code>.htaccess</code> is the preferred method. </p>