title: Are these steps enough to secure a site?
body: <p>I am about to launch my website and security is important so i wanted to outline what I have done to secure the site.  Please correct me if I am wrong and if I need something else:</p>
  
  <ul>
  <li>To connect to our server, I have a two-factor authenitcation enabled via VPN. </li>
  <li>The site uses SSL</li>
  <li>Data is encrypted at rest. </li>
  <li>I have a log monitoring tool </li>
  <li>WHen users enter data into the database i use mysql_real_escape_string(); and when i display user data i use htmlspecialchars(); </li>
  <li><p>Passwords are stored using md5 encryption. </p>
  
  <pre><code>     Sample insert query: 
  
       // I use these on every page
       $username = removeBadChars($_SESSION["username"]);
       $password = removeBadChars($_SESSION["password"]);
  
       //Sanitized data
       $_SESSION["username"] = $username;
       $_SESSION["password"] = $password;
  
       //Query to display 
       $sql = "select `User_name`, `User_id`, `User_kind` from `clientele` 
       where `username` =   '$username' AND `password`='$password'";
       $query = mysql_query($sql) or die ("Error: ".mysql_error());
  
        while ($row = mysql_fetch_array($query)){
  
    $name = htmlspecialchars($row['User_name']);
    $uid = htmlspecialchars($row['User_id']);
    $uis = htmlspecialchars($row['User_kind']);
  
        }
        mysql_free_result($query);
  
  
  
        //Insert Query
  
        $title = mysql_real_escape_string($_POST['title']);
        $comment = mysql_real_escape_string($_POST['comment']);
  
        $insert = "INSERT INTO table (Title, Comment)
        VALUES ('".$title."', '".$comment."')";
  
         $query = mysql_query($insert) or die ("Error: ".mysql_error());
  </code></pre></li>
  </ul>