Frank has a great blog entry about web application security
He then recommends “Open Web Application Security Project" for anyone interested in web application security and also he recommends a document "A Guide to Building Secure Web Applications". A very entertaining and interesting post by Frank.