The typical approach is to use realpath(). That would expand out any relative portions of the path, which you could then compare directly with the expected path and know for sure it's in a subdirectory of your intended photo directory.
If you go that way, though, you'll also want to stop using the literal '/' and use the DIRECTORY_SEPARATOR constant so that your script runs on windows. realpath(), aside from expanding relative paths, would convert / to \ on a windows platform.
If you go that way, though, you'll also want to stop using the literal '/' and use the DIRECTORY_SEPARATOR constant so that your script runs on windows. realpath(), aside from expanding relative paths, would convert / to \ on a windows platform.