The OWASP top ten is an important list to get under control, but it is necessarily a little vague and make be difficult to translate the generalized best-practices into coding suggestions.
A good rule to keep in mind is always assume your input is malicious, no matter where it comes from, as it can be difficult to imagine just how malicious input can be from even the most innocent of sources. Never assume that user-provided values are limited to the options you gave them to choose from, never assume that submitted content is limited to a given character set or content type.
I'd recommend using one of the many MVC frameworks for PHP, since they frequently provide things like modularity, routing, database abstraction, etc., which you would probably have to write yourself, and which are places mistakes frequently are made. At the very least, read other peoples' code and understand why they did what they did, and what sort of mistakes they're avoiding.
In fact, I'd recommend downloading several of these frameworks; CakePHP, CodeIgniter, Kohana, etc., and reading and understanding each component before you attempt to write your own. It may sound like a waste of time, but you'll actually waste less time and learn more and learn better practices if you focus more attention on learning other people's code rather than diving in and figuring it out yourself.
Also, as a bit of editorial addition, I'd really recommend against PHP if you have any other options at all; and this is coming from someone who's been programming in PHP since 1998. In the interest of security, sanity, performance, and maintainability, it's difficult to find a worse option than PHP. This has already been covered ad nauseum, so I'll say no more than just make a note here.