Security and form validation

Hello all,

Any opinions on the following would be great.

First, apart from using CFQUERYPARAM, are there any other handy tips for securing an app.

Second, does anyone know of a good server-side validation tutorial, that also re-fills parts of the form that were correct. I have client side working but just incase someone has turned off js, i thought i better include it.

Third, is there any way a user could modify email headers via a form. I know thisis possible when emailing a form in php and just want to check.

Thanks for your thoughts,

may the force be with you,
ad