Overall it is a good tutorial. But I think you might like to add some text covering the list forms of system() and exec(). Along those same lines, you should give some amount of coverage to sysopen() vs open(). Another thing you may want to include is some discussion of cookies and the fact that like the hidden fields, unless you do some form of encrypting or digesting of information, the user is free to edit those at will with the possibility of mucking up your system.
cephas