What are the security implications of using substr() to extract file names in PHP, and how can developers mitigate any risks associated with this approach?

Using substr() to extract file names in PHP can pose security risks if input validation is not performed properly. This can lead to directory traversal attacks where an attacker can access sensitive files on the server. To mitigate this risk, developers should use basename() function to extract file names, which only returns the last component of a path.

$filename = basename($_GET['file']);