Damn Vulnerable Web Application (DVWA)

Classic PHP/MySQL training app exposing OWASP Top 10 issues at four security levels (Low, Medium, High, Impossible).