I know SQL Injection is one... what are the others...
Here is a list of Top 10 Secure Coding practices. It is as good a start as any. Consider #8, Defense in Depth, in particular.
Sending plain text passwords without first encrypting them is never a good idea.
You could consider the chapters of this book to be a pretty good checklist...
19 Deadly Sins of Software Security