Web Security - Recommended Reading?

TechnoFreek

Hi,

I am once again looking for some reading material recommendations to assist with research for my college project (3 tier website)

This time the topic is web security. I am interested in areas such as logon security, database security, spam (e.g. on guestbook), content manipulation etc

All advice appreciated!

Thanks in advance!

democrates

What's your development platform?

In the interim these might be of interest:
http://www.owasp.org/index.php/Main_Page
http://www.webappsec.org/
http://www.cert.org/
http://www.ciac.org/ciac/index.html
http://computersecuritynews.us/
http://www.2600.com/

TechnoFreek

democrates wrote: »

What's your development platform?

In the interim these might be of interest:
http://www.owasp.org/index.php/Main_Page
http://www.webappsec.org/
http://www.cert.org/
http://www.ciac.org/ciac/index.html
http://computersecuritynews.us/
http://www.2600.com/

Thanks democrates, I will be developing with HTML, PHP and MySQL

democrates

You're in luck :
http://www.oreilly.com/catalog/web2apps/chapter/index.html
Sample chapter happens to be the one on security, bank that for starters.

Hacking Web Applications Exposed is in second edition, whether you order or not here's the companion site page of downloads for sql injection etc:
http://www.webhackingexposed.com/tools.html

The only other security book I have is Hacking Linux Exposed but you didn't mention a specific OS so I'm guessing that's sorted.

The three we keep hearing about are xss, sql injection, and csrf. While looking these up on wikipedia is a good start, and googling for articles on solutions can get you a lot, I still find books are best for a balanced foundation, then use online coverage to keep up to date (the name of the game in security).