Current Books on web security

Question

Have you read a book on web application security that could serve as a solid introduction to the subject for beginning web programmers?

So far I've found the following canditates, but none of them seem to be suitable for beginners (I haven't read any of these, this is just my impression from what is available on the web):

• Stuttard, Pinto (2007): The Web Application Hackers Handbook
• Hope, Walther (2009): Web Security Testing Cookbook
• Wells (2007): Securing Ajax Applications
• The OWASP Top 10, 2007 version
• McLure, Shah, Shah (2002): Web Hacking: Attacks and Defense ('Hacking Exposed' Series)

Background: I try to teach basic security in my PHP class. I show some examples of SQL Injection and Cross Site Scripting and then spend a lot of time on prepared statements and Escaping. My lecture notes are in german only.

Question inspired in part by this one

Similar Questions: general security, .NET security, Security+forensics

Answer 1

i didn't mind this one, "Grey hat Python".

It's suitable for a beginner.

It teaches you how to use c and python to do hacking

it teaches you how to build your own debugger and how to hack your own applications using various types of injections.

the book is not excellent, but it gave me a different perspective.

Answer 2

The "Hacking exposed" series are usually a good intro material. I think this one can be a candidate.

Answer 3

You can find more than a dozen suggestions in this popular question: What are good books about security, hacking, and computer forensics?

Answer 4

I know you asked for books, but I don't know of any book that is as good as the OWASP web site. It's kept up-to-date, and the material is explained thoroughly and is easy to understand. Here's a good place to start: http://www.owasp.org/index.php/Category:Principle

They do offer several books, many (if not all) of which are available as free downloads here.

Answer 5

If you are teaching PHP, then I would highly suggest:

Essential PHP Security by Chris Shiflett

Chris was also the project lead on this free php security guide: http://phpsec.org/projects/guide/

Finally, you could also look into:

Web Hacker Boot Camp by Gerald Quakenbush

Answer 6

I really enjoyed reading Chained Exploits it is more like a novel than a textbook! But I'd also agree with Gray Hat Python but be warned - its more about building a debugger than security.