Great tips, however I would expand upon #10. Wrappers make life much easier and make the life of someone who wants to code properly much happier.

I use some very standard 'shortcode' wrappers:

query($SQL) -- like yours in #10, as well as:
query_single($SQL) -- returns the first row
query_all($SQL) -- returns an array with all result rows
query_return($SQL) -- returns mysql_insert_id() so you can easily get the id of the item you inserted.
esc($string) -- shortcode for mysql_real_escape_string($string, $GLOBALS['db_handler'])
he($string) -- htmlentities($string)
ue($string) -- urlencode($string)

I also use some simple systems for things like debug info and notices to users, but that's kinda past the point of this.