It basically boils down to:

1. Don't pass any string directly into SQL without appropriate escaping - ideally use prepared queries
2. Audit use of dangerous functions such as eval(), system() etc, VERY bloody carefully.

There are other attacks you might want to consider as well:

- XSS - consider using a framework to automatically escape HTML in your output (e.g. if using a templating system like smarty)
- CSRF - consider using a framework which provides CSRF protection

Mark