Input paths should be sanitized better to avoid ..././ to ../ abuse

see http://www.exploit-db.com/exploits/24877/