This is an excellent book. However, it's not so much about securing modern web applications as it is about describing browser holes. As it should be, since much of it was taken from Google's Browser Security Handbook -- still, it's distracting to see so much space being devoted to the topic of Java applets and frames when the best way to secure a modern web application is to NOT USE JAVA APPLETS OR FRAMES. So I took off a star for that.

It also falls into the common trap of spending more time detailing the exploits than the techniques used to combat them. I realize to some extent this is a function of there being so many options to write a web application, but it'd be nice to see some worked examples.

That said, this is one of the most complete, comprehensive guides to the rathole that is the Web, and I've already got two more books I want to read just from the footnotes provided on the topic. His analysis of parsing HTML and validating browser input is particularly incisive (if trenchant).