Possible Duplicate:
PHP Session Security
I've just finished coding the basics of a web-app (the main code) and I've integrated a basic user system. This is my first web-app so I'm wondering what are the things that I should use to secure it? I already know about thing like mysql_real_escape_string() and strip_tags() but what else? How would I securely store usernames and passwords through cookies and sessions? Any tips, tutorials, etc. are greatly appreciated!
OWASP has some very helpful guides to the most common vulnerabilities and good recommendations as to how to mitigate them. You should familiarize yourself with the attacks and vulnerabilities they cover.
Reading through these might take time, but there's not too much and it's not particularly dense reading. Maybe you should focus on their top 10 security risks first.
CWE/SANS Top 25 Most Dangerous Software Errors helped me a lot.
real_escape_string only combats MySql injection. Also when a user must input a number, for example, reading newsid=n from a URL like index.php?newsid=3, make sure $_GET['newsid'] is an integer by adding (int) before $_GET['newsid'].
some really basic things ;) hope the link helps.