If you could have only one book on web security, what would it be?
locked by AviD♦ Dec 29 '14 at 12:15
This question exists because it has historical significance, but it is not considered a good, on-topic question for this site so please do not use it as evidence that you can ask similar questions here. This question and its answers are frozen and cannot be changed. See the help center for guidance on writing a good question.
Read more about locked posts here.
Many people do recommend this one book: The Web Application Hacker's Handbook: Discovering and Exploiting Security Flaws, which I also find very useful. But you should not rely upon only on one book. This book was released back in 2007 year, now there have appeared many new technologies. So, besides books you should follow standards, RFC's and other documents. I know other really good and fresh book. I have only hard copy in German, not aware if it is available in English - Sichere Webanwendugen.
Since it's now out, my answer would be The Tangled Web by Michal Zalewski.
For books on how to build web security, Writing Secure Code v2 from MS Press is still a seminal classic, and even though it was written quite a few years ago by Internet standards, it is still very relevant, and relatively up to date (if no longer complete because of new attack techniques). And it's not just for MS platforms (though many of the newer frameworks are missing)...
Ross Anderson's Security Engineering is excellent (and the first edition is currently available online. Some sample chapters from the second edition are online at the time of writing).
I prefer Hunting Security Bugs to The Web Application Hacker's Handbook, but fortunately, you can have more than one book in your life. I have about 40,000.
I nice introductionary book to web security I am reading now is Hacking: The Next Generation.
It covers a wide range of topics, so maybe it could not be for you if you are looking for something deeper and more focused.
the Web Application Hackers handbook v2 and as a hacker/security guy one book is not what you look for ,also OWASP books are very good in the subject