I'll second this. This book hits upon most common security vectors. It's amazing how few developers know what csrf is and how to defend against it even now. If you're not ready to invest money yet, check out the owasp top 10 and make sure you know how to defend against them in your preferred language/framework.