The greatest weakness in many PHP programs is not
inherent in the language itself, but merely an issue of code
not being written with security in mind. For this reason, you
should always take the time to consider the implications of a
given piece of code, to ascertain the possible damage if an
unexpected variable is submitted to it.
Will this script only affect the intended files?
Can unusual or undesirable data be acted upon?
Can this script be used in unintended ways?
Can this be used in conjunction with other scripts
in a negative manner?
Will any transactions be adequately logged?
You may also want to consider turning off
register_globals, magic_quotes, or other convenience settings
which may confuse you as to the validity, source, or value of
a given variable. Working with PHP in error_reporting(E_ALL)
mode can also help warn you about variables being used before
they are checked or initialized (so you can prevent unusual
data from being operated upon).