title: How much security is really needed on a "private" website?
body: <p>I'm asking this as I maintain a small website for a fairly isolated group of people (no more than 80). It currently has a simple log in function (e-mail, password) and the data that is "protected" is merely contact information to our members (telephone, address, e-mail). The website is written in PHP and use My SQL.</p>
  
  <p>These last couple of days, I've been reading through the forums and other sites about web site security, since I would like to enhance it on our site. Right now the security consists of SQL-injection protection and MD5-hashed passwords stored in a database. This feels abit inadequate but I also feel that it's easy to take it TOO far. I mean it's not exactly nuclear launch codes here, but data people usually feel abit unconfortable to display online. The site itself is hosted by a fairly renown web host.</p>
  
  <p>The only threat I can see right now are pranksters stumbling across the site and trying some of their home made concotion?</p>
  
  <p>So I thought somewhere in the middle would suffice. Like</p>
  
  <ul>
  <li>SQL-injection protection (enhance if needed)</li>
  <li>Stronger hash method with salt</li>
  <li>XSS-protection</li>
  <li>DDoS-protection</li>
  <li>SSL when accessing the member area</li>
  </ul>
  
  <p>What do you more experienced people out ther think?</p>
  
  <p>Update: I would like to add that I do everything myself and there is no budget for buying fancy crypto techniques or hiring professional programmers.</p>