You could search around here for specific tidbits (search for the word "censor", for example) or more general considerations (e.g., here.) There's also the chapter in the PHP manual on Security it would pay to read.
When it comes to text boxes, or any user input, the general principle is to be paranoid. Never trust anything coming in from the outside world to be innocent. Don't trust the form field contents, don't trust the URLs, don't trust the request headers (given that it got through your web server and got to PHP, you can presumably be confident that it really is an http request). Don't use any of this info until it's been properly checked out. Things like taking user input and building any sort of system command (including directory and filenames) out of them (the sort of places where words like "mysql', "root" "bin", etc. would be used to do things) are especially dangerous - it's basically an invitation to the world to do whatever it likes to your machine.
