There's a lot of great content out there. Start here:
https://www.owasp.org/tl;dr Don't trust anything that a web browser (or any client app) sends your servers. Treat data as actively hostile. Use high quality open source projects where you can because they've done all the hard learning for you.
