Filtering data with a default deny regular expression

Running the application with the least privilege necessary

Client side data validation

Retrieving data from database using pre-compiled stored procedures