Pick a vulnerability to learn about

SQL Injection

SQL injection is a type of injection attackers, can run arbitrary commands against your database.

If your site allows users to add content, you need to be sure that attackers cannot inject malicious JavaScript.

If your application calls out to the OS, you need to be sure command strings are securely constructed

As an application author, you need to be sure your users aren't having their clicks stolen by attackers.

If an attacker can forge HTTP requests to your site, they may be able to trick your users into triggering unintended actions.

Ensure file paths are safely interpreted, or hackers can access sensitive files on your server.

When building a website, you need to be sure you do not accidentally create a channel that allows malicious JavaScript to be bounced off your server.

If you make use of URI fragments in your site, you need to ensure they cannot be abused to inject malicious JavaScript.

File uploads are an easy way for an attacker to inject malicious code into your application.

All resources on your site need to have access control implemented, even if they aren't intended to be discoverable by a user.

Most web-applications make use of redirects. If your site forwards to URLs supplied in a query string, you could be enabling phishing attacks.

Insufficient encryption can make you vulnerable to monster-in-the-middle attacks.