There are some targets to practice on (such as WebGoat[1]) in the answers to this security.stackexchange question:

http://security.stackexchange.com/questions/21523/sample-vul...

[1] https://www.owasp.org/index.php/Category%3aOWASP_WebGoat_Pro...