Kendo,
I agree with Klotzki. Some of the tips I use:
1. When you want to check for the existence of a variable, use <cfif isDefined("form.variable"

>. I used to CFPARAM my variables, then check for len, but isDefined is faster.
2. Scope your variables. A local variable would be "variables.variableName"; form variables would be "form.variableName", and so on.
3. When you're doing queries, prefix the column you're selecting with the table name.
<cfquery name="getbooks" datasource="ingram">
select books.title, books.author, books.ISBN
from books
where bookID=<cfqueryparam value="#url.bookID#" cfsqltype="CF_SQL_VARCHAR">
</cfquery>
Two other things I'd like to point out in the above statement:
3a. Don't use "select *"; list out the columns you need.
3b. When you have a WHERE clause that has a variable in it, use CFQUERYPARAM to scope that variable a little more tightly. There's about 8 different types, some of which your DB driver may not support, but at the very least, you can use CF_SQL_VARCHAR and CF_SQL_INTEGER. This is also a security patch.
4. If you have more than 3 possible conditions in a CFIF, put it in a CFCASE statement instead.
That's about all I can think of off the top of my head. HTH.