Good tips. I must add that I would not count on them knowing what they are doing. They may get you something usable but it usually won't be good practices. See

Good tips. I must add that I would not count on them knowing what they are doing. They may get you something usable but it usually won't be good practices. See the comment above about unfiltered SQL statements in the GET requests. If you don't know why that is a bad thing then when you get the code back from the people and it has this type of huge security error you will not know what to look for. That being said I think there is a fair bit of work that can be safely outsourced to these people without too much fear of security. PSD to HTML slicing, etc.... But the old adage applies that you get what you pay for.