Hello everyone, especially those with experience .
I have an app that depends on
Login data (username and password)
Fetches user data from the server (location data , account status, etc.)
Collecting the customer's request (products, prices, etc.) and uploading it to the database
Fetching old orders and their details from the database
What data should be protected in the first place and what is the best way to protect and where the protection is in the application or in the server or both
Does the site's security lie in the strength of the password or are there other things?
How is the database protected?
I use PHP files for connect with database
Please explain to beginners like me in a simple way.