Code golf sites, such as golf.shinh.org run arbitrary submitted code in some sort of chroot jail I think. You could find exactly what shinh does from the site source code.

A while back, I prepared a general security checklist in On Coding Standards and Code Reviews which might be of some use.

Update: See also Re: Security techniques every programmer should know (Security References) (a long list of Security references)