Comment by briandh

The Tangled Web: A Guide to Securing Modern Web Applications is a good complement.