top two php security practises

filter input
escape output

These two security patches has been devised by Chris Shiflett  and can be found here. Generally these are the basic security measures one can take to provide the most common attack a stop on php applications.