to protect against purposely malformed input that could cause your system to misbehave
unless you know that your client-side software is already doing the filtering
Always assume a bad guy won't use your client software to contact your server. Don't rely on client side validation for security. Use client-side validation in addition to server-side validation as a CONVENIENCE: to reduce latency for the client and to avoid burdening your server with requests that will simply fail.

True, thank goodness all those problems are long gone now that we have IL
False, you can still overflow buffers in Managed C++ and even in C# if you're using pointers

Dangerous, because a single file can have many, many names
Fine as long as you make sure there's no trailing dot on the end of the filename
Fine as long as you make sure to convert it to a long filename first

not worry about security issues if you're in .NET, because code access security will keep you safe.
connect to the database as the database owner, because, well, you own the darn thing!
connect to the database with the least amount of privilege to get your work done
use stored procedures or parameterized queries to keep malformed user input from changing the meaning of your SQL statement
c and d

choosing a process identity for your server to grant it just enough permissions to get its job done and no more
connecting to databases using minimal permissions
opening files and other kernel objects for only the permissions you really need
all of the above