by Dafydd Stuttard & Marcus Pinto: Though aging, it remains the definitive guide for understanding web security flaws like SQL injection and XSS.