basename() / dirname() / pathinfo() / glob() Since: PHP 4（2000）

// Returns the file name from a path.
basename($path, $suffix);

// Returns the directory portion of a path.
dirname($path, $levels);

// Breaks a path into directory name, file name, and extension.
pathinfo($path, $flags);

// Returns the canonicalized absolute path, resolving symbolic links.
realpath($path);

// Returns an array of file paths matching a pattern.
glob($pattern, $flags);

// Returns a list of files and directories inside a directory.
scandir($directory, $sorting_order);

『basename()』 and 『dirname()』 return a string. 『pathinfo()』 returns an associative array when the second argument is omitted, or a string when a flag is specified. 『realpath()』 returns a string on success and 『false』 on failure. 『glob()』 and 『scandir()』 return an array.

<?php
// Use basename() to get the file name from a path.
echo basename("/var/www/html/images/photo.jpg"); // Outputs 『photo.jpg』.

// Get the file name without its extension.
echo basename("/var/www/html/style.css", ".css"); // Outputs 『style』.

// Use dirname() to get the directory portion of a path.
echo dirname("/var/www/html/images/photo.jpg"); // Outputs 『/var/www/html/images』.

// Get the directory two levels up.
echo dirname("/var/www/html/images/photo.jpg", 2); // Outputs 『/var/www/html』.

// Use pathinfo() to break a path into its components.
$info = pathinfo("/var/www/html/images/photo.jpg");
echo $info["dirname"]; // Outputs 『/var/www/html/images』.
echo $info["basename"]; // Outputs 『photo.jpg』.
echo $info["extension"]; // Outputs 『jpg』.
echo $info["filename"]; // Outputs 『photo』.

// Retrieve only a specific piece of information.
$ext = pathinfo("/var/www/html/report.pdf", PATHINFO_EXTENSION);
echo $ext; // Outputs 『pdf』.

// Use realpath() to resolve a path to its absolute form.
echo realpath("./config/../data/users.json"); // Outputs something like 『/var/www/html/data/users.json』.

// Returns false for a path that does not exist.
var_dump(realpath("/not/exist/path")); // Outputs 『bool(false)』.

// Use glob() to search for files.
$images = glob("/var/www/html/images/*.jpg");
foreach ($images as $file) {
    echo basename($file) . "\n"; // Outputs the name of each matched JPG file.
}

// Search for multiple extensions with glob().
$files = glob("/var/www/html/uploads/*.{jpg,png,gif}", GLOB_BRACE);
echo count($files) . " image file(s) found.";

// Use scandir() to list the contents of a directory.
$entries = scandir("/var/www/html/");
foreach ($entries as $entry) {
    if ($entry === "." || $entry === "..") continue; // Skip the current and parent directory entries.
    echo $entry . "\n"; // Outputs each file and directory name.
}

// Practical example: protection against directory traversal
$user_input = "../../etc/passwd";
$safe_name = basename($user_input); // Extracts only 『passwd』.
$full_path = realpath("/var/www/html/uploads/" . $safe_name);
if ($full_path && strpos($full_path, "/var/www/html/uploads/") === 0) {
    echo "Safe path: " . $full_path;
} else {
    echo "Invalid path specified.";
}

Path manipulation functions are fundamental to any program that works with the file system. 『basename()』 plays an important role as a defense against directory traversal attacks by safely extracting just the file name from user input.

『glob()』 searches for files using the same wildcard syntax as the shell: 『*』 matches any string and 『?』 matches any single character. The 『GLOB_BRACE』 flag lets you search for multiple patterns at once, such as 『*.{jpg,png}』. While 『scandir()』 returns every entry in a directory, 『glob()』 returns only entries that match the pattern — choose the function that fits your use case.

『realpath()』 returns 『false』 for paths that do not exist, so it also serves as an implicit file existence check. A common security pattern is to use 『realpath()』 to canonicalize the path and then verify with 『strpos()』 that it falls within an allowed directory. For reading and writing file contents, use 『file_get_contents() / file_put_contents()』.