There's a lot to learn from doing things from scratch, but it inevitably opens yourself up to input validation issues such as sql injection. While I agree, as a learning tool, starting from scratch can be useful I feel as though any site going into production ought to be using at least some sort of framework to handle at least the database queries to avoid most of the gotchya moments. I'm not saying frameworks make development foolproof, there will always be a better fool, but they do help clean things up quite a bit, and will include optimizations a new programmer won't know to make.