- In my projects, I rarely run ad-hoc insert/update/delete queries on live production database. Instead, I write scripts using the language I used for the app f

- In my projects, I rarely run ad-hoc insert/update/delete queries on live production database. Instead, I write scripts using the language I used for the app for all database operations. I test the script on a local database, make sure there is no unintended side effects, than run the script on the production database, thus avoiding any chance of typos or wrong queries messing with the database. In any case, I also take a backup right before I run the script on production. - For SQL injection, if you are using an ORM or library, it should have safe parameter binding for queries, make sure to follow its guidelines. - It's mandatory to have an automated backup system for your database to ensure you can recover from any data loss scenario. Remember, a backup is only valid if you have tested to restore your database from it. So ideally your automated backup system should also check if the backup is working properly. I realize it's a lot of work, but it'll pay off when (not if) you encounter a disaster scenario that requires you to restore from backup. At the very least, create an automated backup solution, and test it manually periodically to make sure it's working properly. Store your backups in two or more separate places, if possible. Always encrypt your backups. You can check out Tarsnap.