Lockdown environment
Coding
Libraries and frameworks
Protocols
Databases
API
Security testing
Always assume that user data is malicious until it has been verified, and even then, be careful.