Secure for everyone and everything can not be done in any system of a decent size. In practice, there is always a point where the cost of closing a potential hole will be so high that you'd be better off not implementing the feature.

For instance: do you want to protect yourself against users putting up "illegal" content? (yes, there is such a thing, at least where I live)

Other example: what about DOS attacks?

It's a matter of risk vs usability vs cost of implementation. You really should read the OWASP guide if you want to know about more potential problemns.

Joost