Ask HN: What's the best book/resource to learn web application security?

I recommend Troy Hunt's Hack Yourself First course as a good hands on introduction:

https://www.pluralsight.com/courses/hack-yourself-first