Secure file/directory path

[dawwin]

Hello,
I wrote simple http server and I've got following question: What should I do to make path to directory/file secure? String ".." (parent directory) is already forbidden but I'm not sure it's all.
My server creates full path like this
www_dir + / + path_from_http_header
www_dir = '/var/www' by default

[Some Penguin]

You could always run the server with a user account that has very few permissions.