PHP Security Guide & Checklist for Websites and Web Applications – Bottom Line for Every Good PHP Developer

http://www.kavoir.com/2010/03/php-security-checklist-for-websites-and-web-applications-bottom-line-for-every-good-php-developers.html

PDF version
http://www.cenzic.com/downloads/Cenzic_AppSecTrends_Q1-Q2-2009.pdf