I just got a job making a CMS and website for a school nearby, very basic user login and profile system but I've never been to keen on spotting security issues. So I'm going to ask here, what are the main things I need to worry about when programming this CMS? I plan to use PHP with mysql for the database, other then sql injection is there any other major bugs to watch for, or any ways for hackers to get into the database?

Cross Site Scripting vulnerabilities
Edit: Here's a good read for you
http://ha.ckers.org/xss.html
http://quickwired.com/kallahar/smallprojects/php_xss_filter_function.php