I really like your book!
I wish I knew PHP & MySQL as well as you do!
Anyway, I intend to have an e-commerce site going someday and security is of course something I'm paranoid about. I don't trust myself with handling all the security because I'd never feel peace of mind.
Are there companies who test the security of your website for you? You know... who try to mess things up, look for holes, try to get the information you're protecting, etc., then report to you what needs to be changed.
You'd have to trust these companies of course...
Thanks