Beyond SQL injections and XSS

I'm a programmer working on a web service (by myself). Given the fact that I am not a security expert, I came to this website to ask my question.

I did all the major things to secure my website. I tried to protected against...

1. SQL injections by using prepared statements.


2. XSS Attacks by using json_encode(htmlspecialchars($str)); when sending users' string inputs (all my data is sent via JSON).


3. Password compromises by using the following function to encrypt passwords:

[I found this online but should I use bcrypt instead of crypt?]

$cost = 10;
$salt = strtr(base64_encode(mcrypt_create_iv(16, MCRYPT_DEV_URANDOM)), '+', '.');
$salt = sprintf("$2a$%02d$", $cost) . $salt;
$password = crypt($pass, $salt);

And then to log in:

if (crypt($pass, $realpass) == $realpass)
{ //$pass = entered password, $realpass = database
    //yay
}

In addition, there are a number of things on top of my head that I did not account for. These include:

1. Uploading to server - can images/videos be malicious if edited with imagick/ffmpeg?


2. Legality - How to sanitize illegal content (i.e. child porn, etc.) or even illicit content (i.e. nudity)?

I also didn't worry about command/code injection since I don't have any executions vulnerable to those. Oh and, of course, I'm sending/receiving everything over HTTPS.

HOWEVER, I'm sure all of you are sitting there at home laughing at my stupidity in the subject. Security experts are not paid a salary to, you know, secure against things as elementary as SQL injections. I seriously doubt that any major security breaches occur because of any of the potential security breaches I listed above.

And so my question is, what am I missing? It's worth noting that I'm going to use AWS's EC2, hence I don't know if I need to take extra security measures to the server or not.

Thanks in advance.