This is a nice list of some gotchas. The writer’s focus is on security, but many of them are even more fundamental: program correctness - do these statements really do what you intended for them to do?