Use prepared statements to pretect against SQLI!!!!

Put the DB on a separate server. Don't access DB directly from the web app; access it through services. Set up a robust authentication system for your services (OAuth?)