Input Filtering & Bypassing
Filters are always great as an additional layer of security, but they shouldn't be your only line of defense, because generally, filters are missing context, thus making 100% secure filtering impossible.
For example, your filter doesn't know anything about the underlying OS. Does it accept
\ as directory separator? If so,
..\ may work. @Technidev mentioned another issue with
..\/. Depending on the OS, other attacks may work as well (for example, there may be a character that is ignored when treating paths, but not when filtering; I tried
%00 as an example, but it doesn't work). There shouldn't be a general bypass that will work independently of OS though.
A better - but possibly too restrictive - filter would filter for
Your implied question seems to be if this code is secure, or how to make it more secure.
If you don't need a path, just use
basename, which will return a file name.
If you do need a path, but it should be inside the docs directory, resolve the path and compare it to the base path.