I'm about to create a web app that is php/mysql based. It should contain multiple users and two levels of admin accounts.

It will most likely not be very likely to be attacked in any way. Still I am concerned about safety since I'm nowhere near an online security expert.

What are some good basic security practices for writing such a program?

I will rent space at a web hotel which I assume keeps the basic installation at a reasonably safe level.