How to secure your PHP scripts

<?php

if ()
{
}
if ()
{
}
else
{
}
if ()
{
}
else
	if ()
	{
	}
	else
	{
	}
	
?>

<?php
      if ():
      endif;
      if ():
      else:
      endif;
      if ():
      elseif ():
      else:
      endif;
?>

<?php
      if (!get_magic_quotes_gpc()):
      // code here
      else:
      // code here
      endif;
?>

<?php
$input = $_POST['text']; // You can use post, get, cookie or anything you like.
if (!get_magic_quotes_gpc()): // Checks if magic quotes is on or not
	$input = addslashes($input); // If its not on, add slashes
endif;
$query = mysql_query("INSERT ... {$input} ... ;"); // A query lol

?>

<?php
$query = mysql_query("SELECT ... FROM ... LIMIT ... ;");
while ($result = mysql_fetch_assoc($query)):
	echo stripslashes($result['column']);
endwhile;
?>

<?php
$password = $_POST['password'];
if (get_magic_quotes_gpc()): // Checks to see if magic quotes is enabled
	$password = stripslashes($password); // If it is, strip the slashes it added.
endif;
/* Ok you may be wondering why i done that check when the text is going to be encrypted anyway.
Well this is because some servers have magic quotes enabled and some dont. Lets say you didnt
use that if statement and u had people with passwords that have quotes. The password will be
encrypted without the magic quotes effect. Now imagine you got a new host this time with magic
quotes enabled. Because u encrypted the passwords without magic quotes and the new server has
it enabled, when someone with quotes in their password goes to log in, the hashes wont match. */
// The first encryption way
$password = sha1(md5($password));
/* This is very simple. It md5 then sha1s the password. Very effective at hashing. But what
if you are extra paranoid? If someone gets their hands on your hash, if they are smart they
will know its a sha hash. Theoretically once they crack it, they just have to crack the md5 hash
afterwards and theres your password (i said theoretically, this would take years to crack even
with supercomputers) */
// The second encryption way (for the paranoid, like me)
// First we define my hashing function "Xel"
function xel($str)
{
	$str = sha1(md5($str, true)); // First returns the binary md5 of the input then sha1s it
	$str = preg_replace("/([0-9])/e", "chr(97 + intval('\\1'))", $str); // Replaces all numbers with letters (0-9, a-j)
	$str = str_rot13($str); // Performs a simple rot13 algorithm on it
	return $str; // Returns the "Xel" hash
}
// How to use it
$password = xel($password);
/* This will return a hash that looks something like this:
uroorrnuqtpupppoprqqvsnntntnorsuvnrvnopn */
?>

<?php
if ($result['admin']):
	$admin = true;
endif;
// Now the admin variable only gets initiated if $result['admin'] is true (has a value other then false)
// ... further along the script ...
if ($admin):
	// do some admin stuff
	#
endif;
#
/* Now this if statement will be looking for $admin. If it finds admin with the value
of true then it will do some admin stuff. However, if the admin variable wasnt created,
the if statement cannot find the variable so assumes it as false. So far nothing of concern right?
Heres were i forget some stuff so i will try to explain what i mean:
Some php installations by default create variables from $_GET and $_POST strings. What i mean is:
index.php?someattr=abc&etc=etc...
Once index.php is run, a variable called $someattr with the value of abc is now accessable by the script.
It is also accessable by $_GET['someattr'] and $HTTP_GET_VARS['someattr'] etc...
Now in our above example, the admin variable has not been created. All someone has to do is
page.php?admin=true
and they have admin rights because the $admin variable is created with the value of true
As you can see, this can be a big problem if not protected against
Stopping this is really simple, just define the admin variable */
. . . 
$admin = false;
if ($result['admin']):
	$admin = true;
endif;
// Simple as that


?>