Learn to Hack
Have them hack real, vulnerable applications in the browser, then see how the code can be made secure
hacksplaining.com
Completely free, comprehensive security training for web developers. Covers every major security vulnerability you are likely to face. Concrete, no-nonsense advice for the developer in a hurry.