24536. http://www.tonyspencer.com/2005/12/15/email-injection-exploit-through-a-php-contact-form/
As you can see it is easy to manipulate the headers and as a result you can get really fancy and change the subject of the email, mime-type, sender, and the body of the message. The end result is an email open relay.
23286. http://www.phparch.com/2010/07/08/never-use-_get-again/
You don’t need to use $_GET or $_POST anymore. In fact, you probably shouldn’t use $_GET and $_POST anymore. Since PHP 5.2, there is a new and better way to safely retrieve user-submitted data.
16199. http://knol.google.com/k/jochen-jung/securing-php-web-applications/kudg1x702urr/8#
This essay describes how one can harden his web application against different attacking techniques. As an example it uses Lansuite (www.lansuite.de), an CMS system designed for Lanpartys, I am writing on.
932. http://www.hardened-php.net/suhosin/index.html