As a programmer myself, here's a few of my security tips.
Image upload
Make sure to check the real extension of the file and not just the MIME-type.
MIME-types can easily be spoofed and trick an image upload script to upload a PHP or ASP page.
Escape HTML
When using forms, always remember to use htmlentities() or a similar function if the submitted data is to be printed out on any HTML page again.
Allowing javascript or HTML to be executed on the client could lead to stolen session IDs, thus allowing anybody to steal your session ID when you're signed in as the administrator.
Download scripts
If you're planning on using a download script which uses the readfile() function in PHP, remember to never use any variable sent by the user inside the readfile function. You could easily go up one or a few directories by adding ../ in the variable.
Here's an example.
<?php
header("Content-type: Image/PNG");
readfile("img/".$_GET['user_id'].".png");
?>
So how could you hack that code? Easy, you simply has to access "script.php?user_id=../index.php%00". This will give you the full source code of the index page in the parent directory. Using the NULL-byte (%00) allows me to remove the .png extension.
Validate form data
HTML forms are validated on the client side, allowing the restrictions (example: maxlength) to be overridden by the client. You should use strlen() to check on the server side if the text really is within its limits.
Another common problem programmers do not care about is drop down lists. As with maxlength, a drop down list can be modified by the client. I've run across a few big sites which do not validate what I submit using a drop down list. This would, for example, allow me to put HTML or Javascript on my profile page.
Not using die(); when redirecting
Lets say you have an administration page on your server. This would be the code:
<?php
if (!$_SESSION['admin']) {
header("Location: login.php");
}
if (isset($_GET['make_user_admin']) {
function_for_making_a_user_admin($_GET['make_user_admin']);
}
?>
Sure, if you access the admin page without a valid session, you would get sent to login.php. However, the server would still continue to process your request, even after the redirection. You could also use a telnet client to get the HTML out of the page without beeing redirected. This would allow us to know that you could send the variable make_user_admin via GET, if there was a form on the admin page. If we requested admin.php?make_user_admin=your_username, it would allow you to login to the page as a real administrator.
If we've used die() after the redirection, none of the pages HTML code would get sent to the client, regardless if you used a telnet client or a web browser. You would also be unable to execute function_for_making_a_user_admin().
Escape data in exec(), shell_exec() and similar functions
If you're using a script to execute a command on your computer which includes some text the user has given, make sure to escape that text.
<?php
echo shell_exec("status.exe -check ".$_GET['user']);
?>
In the above example, we're using status.exe to check for information about the user $_GET['user']. A normal request could look like this: "script.php?check=cmxflash". Lets say we requested this instead: "script.php?check=cmxflash&shutdown -f -s -t 30 -c pwnd by teh skiddie". The server would split the request into two parts, "cmxflash" and "shutdown -f -s -t 30 -c pwnd by teh skiddie". The 2:nd part would shut down your server.