<?php
// Resolve and sanitize the requested path
function resolve_path($root, $rel) {
    $base = realpath($root);
    $full = realpath($root . '/' . $rel);

    // If invalid or outside root, reset to base
    if ($full === false || strpos($full, $base) !== 0) {
        return [$base, ''];
    }

    // Clean relative path
    $rel = trim(str_replace($base, '', $full), '/');
    return [$full, $rel];
}