In addition it's highly recommended you consider the module development templates discussed in this blog . The blog entry also links to a short video explaining how to use these templates.
Don't use Session variables. Session variables can cause issues when running in webfarm scenarios. Neither DotNetNuke or any of the core projects use session variables for this reason.
Don't trust user input - if you need to accept user input you should use the PortalSecurity InputFilter methods to filter the content as required.