Protecting your website

If your site has forms, validate the input
Validate for common unix/linux commands and mysql injection attacks
Validate for any awkward characters
Allow only letters a-z as input characters for forms
Hide your database connection file outside of your web root
Consider using Stored_Procedures on your database.
They should be used only if security is a major concern