Use a templating system such as Smarty, and have it automatically escape all fields output (unless you explicitly disable the modifier).
Use PDO prepared statements for all database queries, never just stick strings together.
These steps together will solve the two biggest problems.
But it won't protect against CSRF, that's trickier.
Mark
