Specifically regarding user input security:
• Whitelist user input where possible, do not try to blacklist known dangerous characters. There are too many conflicting rendering ideologies for HTML between Chrome, Firefox and Internet Explorer for this to be feasible. For example, a language parameter's value in a POST request to change user settings should be whitelisted to things like "en" - there is no reason to allow "%0aSet-Cookie:%20", which could cause HTTP Header Injection. Absolutely do not try to be clever and sanitize specific tags like "<script>"
• Thoroughly escape dangerous characters if they must be represented. Use a well-tested library for this, do not try to roll your own.
• Do not allow user-input for filenames, especially if the file needs to be uploaded to a privileged directory (also avoid, where possible).
OWASP is unfortunately an inconsistent guide at best. security.stackexchange and /r/netsec are better.
Security is aggressively difficult. OP, if you have any more specific security questions you're welcome to email me and I'll help you out, free of charge.
The absolute best thing you can do to help yourself with security right now as a self-taught programmer is to thoroughly familiarize yourself with:
1. The nuances of your chosen language, and
2. The best libraries for security, authentication and input handling in your chosen language and framework.
For example, if you are a Ruby programmer you should immediately know about e.g. the dangers of passing user input to send() and how Ruby's REGEX functions a bit differently than other languages. You should also know the best authentication libraries off the top of your head and make use of them instead of trying to reinvent the wheel.