PHP security code Audit Manual [summary]

Variables that can be input by users in PHP

$_SERVER $_GET $_POST $_COOKIE $_REQUEST $_FILES $_ENV $_HTTP_COOKIE_VARS $_HTTP_ENV_VARS $_HTTP_GET_VARS $_HTTP_POST_FILES $_HTTP_POST_VARS $_HTTP_SERVER_VARS 

Functions that may allow command injection

system exec passthru `` shell_exec popen proc_open pcntl_exec 

Functions that may allow file inclusion

include include_once require require_once show_source highlight_file readfile file_get_contents fopen file 

Functions that may allow code injection

 eval preg_replace+/e assert call_user_func call_user_func_array create_function 

SQL statement functions that may allow SQL Injection
Insert
Delete
Update
Select

Functions that may allow attackers to operate files maliciously

copy rmdir unlink delete fwrite chmod fgetc fgetcsv fgets fgetss file file_get_contents fread readfile ftruncate file_put_contents fputcsv fputs 

More:
Http://ir.php.net/manual/en/ref.filesystem.php