http://www.irongeek.com/i.php?page=security/deliberately-insecure-web-applications-for-learning-web-app-security