Web Insecurity: Preparing some curricula on web security

What would you want to learn in a short course on web security? What do you wish other people knew about web security?

I'm preparing curricula for a day and a half of training, and I'd love some suggestions and advice on what to cover.