php - Securing my web app with codeigniter: holes? -

i'm building web app , want add "decent" level of security. it's not next generation bankingplatform overkill not necessairy. however, want protection against local neighbourhood hacker, since app has estimated use of 10k users.

to accomplish this, i'd figure try codeigniter. i'm not custom framework, i'll using "easier" security handling. note i'm not expert in web security.

basicly, i'll add/modify code this:

• dealing sql-injection: using query binding.

• dealing xss: enabling in config file: $config['global_xss_filtering'] = true; . docs the filter run automatically every time encounters post or cookie data. how can secure output (using codeingniter), than? $name = $_get['name']; echo "hi $name!";

• dealing csrf: enabling in config file: $config['csrf_protection'] = true;

• dealing session hacks: using session this: $this->session->userdata('userid');

as said, i'm no security expert, , wonder wheter or not these (and these) modifications give me acceptable level off security. or there serious security threads still require looking into?

some other notes on application:

• my app doesn't allow users upload files server.
• the login done facebook. on important pages, validate access token (wheter or not it's issued app, wheter or not it's issued current logged user, etc. if not, page won't load), , permission/admin rights, assume autorization , authentication part secure enough.