Be careful with eval()
Be careful when using register_globals = ON
Never run unescaped queries
For protected areas, use sessions or validate the login every time.
If you don't want the file contents to be seen, give the file a .php extension.