Need to establish full $file path first

Otherwise we won't have a valid fullpath to find $docRoot in
Establish realpath test begins with $docRoot or die

No need to str_replace ../, as that isn't real protection, use realpath
instead
Always turn into a real path (we'll only pass relative paths here
anyway), and change \ to / on Windows setups
Only if file exists and begins with the root path do anything, die
otherwise