If I want to be very good at security and especially web security, then must I learn languages? I mean things like PHP, C#, java, etc? If not then what should I learn exactly? and do you know any good book for a beginner?
A great book for a beginner are the Security+ preparation books as they provide a great, broad discussion of many different topics in the security field.
As far as a language is concerned a great security professional knows a vast majority of languages as it allows them to react to different needs. If it is your first language, I would recommend C++ and then later Python. There is a fabulous book on Python and its use in security titled, Gray Hat Python: Python Programming for Hackers and Reverse Engineers. I might also recommend the CEH test book and the CCNA test prep. These are a few books I couldn't go without.
Hope this helps.
It depends on what 'good at security' and 'good at web security' means to you.
If you want to help people find flaws in their work, then you'll want to know the languages they use at least on a level comparable to theirs (though presumably with a different focus)
If you want to analyze systems, then you'll want to learn how systems interact (again from a security perspective). In this case the specific languages don't matter as much as the details of the interactions (APIs / protocols)
As far as 'a good book', I would recommend reading as wide a variety of books / documents as you can. IMHO 'good' security comes from experience / breadth and depth of knowledge. If there is a book that you think might impact on something you're interested in, read it. Even if you only skip to the 'good bits', having another viewpoint will have benefit.
I personally would suggest reading things by Dan Kaminsky and Bruce Schneier for mind-opening takes on security. Mr. Schneier is probably a bit easier of a read, while Mr. Kaminsky has deep knowledge and sometimes breaks my head. I like to think of security from a systems perspective, so this selection might show a little of my bias (notably neither of the above authors has a strong focus on 'web security' per-se.)
Security is a complex topic. It involves being able to understand complex systems, work with people, and solve problems with technical, social, and business solutions.
For books, I liked "CISSP All-in-One Exam Guide" by by Shon Harris. It covers the basic theory of security and many sub topics. A great history of IT Security theory can be gleaned by reading Early Computer Security Papers.
I would prefer security experts to know a broad range of relevent topics, because failure to understand a relevent domain can lead to subtle vulnerabilities. However, I was taken to task by Graham Lee, who pointed out diminishing relevance in my list of topics.
First off the three essential components of security are availability, integrity, and confidentiality. Others would add in authenticity and non-repudiation, but I would focus on the first three for someone who is just getting started.
Web security covers all the components, actors, and processes involved in web applications. The major components are the web server, the web browser, and the network connecting web browsers to web servers. The major actors are the web browser user, the web site administrator, the network administrator, and the web application creator. Note that there are typically many people filling a specific role, and there are many more roles.
I'm trying to keep specifics short, so I won't include everything. Specifics are as of this posting (mid-2011).
In my opinion a good consultant (of any kind) is an effective communicator.
Other nice to have areas:
This looks promising: http://mdsec.net/
You have to learn how to build web applications before you can become "very good" at web security. That means you need to know how to build LAMP (Linux Apache MySQL PHP) applications. That means writing not only PHP code, by SQL query statements.
But you can't stop there. You also need to build ASP pages on top of Microsoft SQL.
Once you know how to build these things, you'll have the knowledge to secure/hack them.
To be very good, you will need to invest some time in web languages. You can do many things, without, however.
As to your book question, it's unclear whether you mean for programming, or for security. If security, there are excellent free resources available at the Open Web Application Security Project (OWASP). See the Development Guide, Code Review Guide, and Testing Guide. These are available digitally (for free) or print-on-demand through Lulu.