First of all:
- create a user to run your PHP code as who has no more user rights than needed, including being jailed within his user context
- configure suphp
- get a hardening guide for ubuntu and follow it thoroughly
- configure apparmor
- limit user access and have a remote logging tool set up
- implement auditd for sensitive folders
- set up SSL with a valid certificate (443) if your app handles sensitive information
For MySQL preferably you have a table to which you can only add records. Every record has a field "deleted, to which your user mysql application user can have access. This record can be set to True or False. Your user can insert rows but cannot delete any, he can also only update those fields within a record which should be updated. Deleting can be done by setting True or False (your application needs to account for this).
Use as much stored procedures as possible, off-load as much database logic to your database as you can.
Configure a WebApplication firewall and HIDS.