1. Limit user input to scripts to the expected input.
2. Set the correct (lowest permissions necessary) for all files and directories.
By only allowing only the expected, the dangerous unexpected user input will be rejected.
Google is your friend:
https://www.google.com/search?q=secure+PHP
Lots of opinions and ideas here ^