You mean from a script author perspective, or from a web-manager perspective?

I would agree that input validation is almost everything right there. Personally I find perl to be the easiest language for input validation, probably because I just know it's regular expression forms better than I do for any PHP equivalents.

C/C++ scripting on a web server with compiled CGI? I wouldn't bother writing those. About the only bonus would be nobody can use a source-showing vulnerability to find vulnerabilities within the script itself. But neither can you, and you might need recompilation if you change platforms...