Separate configuration, reusable includes, public pages, administration and assets. Use PDO prepared statements and validation throughout the application.