I still like www.owasp.org for me it's the best web application security site going by a long way!

SittingDuck