These are the best online resources in web application security :

• RSnake’s Blog
• OWASP
• Jeremiah Grossman’s Blog
• The Web Security Mailing List
• sla.ckers.org forum
• Web Application Security Consortium
• Security Focus Web Application Security List
• GNUCITIZEN
• cgisecurit
• Security Focus Hacking Exposed Web Applications, 2nd Edition (Joel Scambray, Mike Shema, Caleb Sima)
• Full Disclosure
• Google
• BugTraq
• XSS (Cross Site Scripting) Cheat Sheet
• Secunia
• Sylvan von Stuppe
• BlackHat
• Schneier on Security
• PaulDotCom
• Professional Pen Testing for Web Applications (Andres Andreu)
• del.icio.us (webapp security)
• FrSIRT
• IEEE S&P OSSTMM
• (IN)SECURE Magazine
• Software Security (Gary McGraw)
• 19 Deadly Sins of Software Security -(Michael Howard, David LeBlanc, John Viega)
• SecuriTeam
• qasec
• WhiteHat Security
• http://www.security.nnov.ru
• Web Security Threat Classification
• http://www.securityfocus.com/archive/107
• How to Break Web Software (Mike Andrews, James A. Whittaker)
• Microsoft
• Security Focus Penetration Testing
• SearchAppSecurity
• National Vulnerability Database
• ComputerWorld Safari Bookshelf