<p><em>This is a shameless information gathering exercise for my own book.</em></p>

<p>One of the talks I give in the community is an introduction to web site vulnerabilities. Usually during the talk I can see at least two members of the audience go very pale; and this is basic stuff, Cross Site Scripting, SQL Injection, Information Leakage, Cross Site Form Requests and so on.</p>

<p>So, if you can think back to being one, as a beginning web developer (be it ASP.NET or not) what do you feel would be useful information about web security and how to develop securely? I will already be covering the <a href="http://www.owasp.org/index.php/OWASP_Top_Ten_Project" rel="nofollow noreferrer">OWASP Top Ten</a></p>

<p>(And yes this means stackoverflow will be in the acknowledgements list if someone comes up with something I haven't thought of yet!)</p>

<p><em>It's all done now, and published, thank you all for your responses</em></p>

Defensive programming as an archetypal topic which covers all the particular attacks, as most, if not all, of them are caused by not thinking defensively enough.
Make that subject the central column of the book . What would've served me well back then was knowing about techniques to never trust anything, not just one stop tips, like "do not allow SQL comments or special chars in your input".
Another interesting thing I'd love to have learned earlier is how to actually test for them.