protecting yourself from things like mysql injection........ thats funky just make sure everything is up 2 date like your mysql or maria db's etc but my 2 cents for web security is
if you do not need ssh access aka remote access 2 the server disable it immediately, this is solid advice i have been brute forced more times than u can imagine simply because i had remote ssh access enabled.
also if you are going too use ssh remember that Using public key authentication for SSH is far more secure than using usernames and passwords to authenticate.
finally if you do not need remote mysql database access than disable it by setting bind-address=127.0.0.1 in my.cnf configuration file