Primer on Web Security
tptacek: I like Dafydd Stuttard's "The Web Application Hacker's Handbook", despite the title. Work through the examples.A lot of people will direct you to OWASP, which is not a bad free tertiary source (owasp.org). There's lots of HOWTO stuff there. Be careful about the OWASP Top 10. You want to know what it is, but it's showing its age.