(9) Rather that mysqli, I would recommend PDO. Parameterized queries handle any escaping you might need, and are awesome. Another plus is if you decide to change databases, PDO can usually adapt (assuming the appropriate DB drivers/modules are install on the server).
(10, 11) I would not use...