Code you or a developer wrote.
THE ESSENTIALS
Parameterise every database query. Never concatenate user input into SQL. Escape output before printing it. Validate uploads properly, and block execution in upload directories. Use CSRF tokens on every form that changes data. Keep credentials in a configuration file outside the web root, with 600 permissions. Set display_errors off and log errors instead.
WHAT GOES WRONG MOST
SQL injection from concatenated queries File upload handlers accepting anything Configuration files inside public_html with credentials in them Debug output left enabled, exposing paths and queries
FILE STRUCTURE
Keep code that does not need to be publicly reachable outside public_html. Only the entry point needs to be web-accessible.
ERROR HANDLING
Handle failure explicitly. A script that assumes the database is available, the file exists and the API responds will fail confusingly when any assumption is wrong.
TESTING
Try entering a quote character in your form fields. A database error means the query is not parameterised.
Try uploading a PHP file to your upload handler. If it succeeds and is executable, fix it immediately.
