Perhaps the fundamental thing to do is to not pay the final 50% until mutually agreed-upon criteria were met.

And for something like this there clearly needs to be a periodic code inspection, or specific guidelines such as anti-sql injection and the like.

Blacklisting this fellow wouldn't necessarily do the job. The hard thing is that you often don't really know if someone is any good unless you work with them, which makes this very hard.