How do you, as a web developer, handle security?

When I say "security" I mean, sanitation of form input, encrypting passwords, etc. Most security methods should just be standard with all websites, but as we have seen with Sony, everything can be hacked. When you develop websites for a client what kind of clauses do you have in your contracts? Say you design a website and later the customer gets hacked and they lose business, data, etc. Do you have a clause to protect yourself?