While cleaning out my desk, I found an old copy of a PHP Quick Reference I helped make a few years ago. On the front page are a few performance and security tips that I thought I'd share. (Performance tips are from George Schlossnagle.)
Performance tips include profile early/profile often, cache when possible and don't over-optimize. The security hints include some of the usual suspects - trust nothing, filter input/escape output and use prepared statements.