Site Suggestions?

[MattF]

True enough, but merely starting with the glaringly bad is as good a place as any to start. Limiting the possibilities of XSS, SQL, directory traversal, file inclusion exploits and such is always a good starting point. Teaching coding style for readability and bug finding is also desirable. The finer points of access permissions etc can always be added later, when there's time and/or opportunity, as those can be more esoteric.