There will never be a single perfect checklist, but here's a few things worth going through:
Wikipedia doesn't do half bad on this one
More for AJAX or other rich interfaces, but worth a read depending on your architecture - OWASP
For an introductory (but thorough) review of web application security, I recommend Michal Zalewski's The Tangled Web. The book comes with checklists (called "security engineering cheat sheets") at the end of each chapter.