A list of things to secure on FM and PHP

Greetings,

About to deploy a fm and php seminar registration system where our staff access the db via filemaker and the customers make bookings via a php webpage.

What I've read tells me to watch out for these problems on the php side:

Rubbish data - I've got input validation on all of the fields, but ultimately if someone wants to submit rubbish there is little I can do about it as the validation only checks that the email address is the right format and that the fields are not empty.

Cross Site Scripting - I'll strip out all tags before allowing the anything into the database

DB connection information - I'll include the connection as a separate file and put it above the web root

And these on the filemaker side:

Accounts and priveleges

Backups

So, what have I left off?

Thanks

Pete