Damn Vulnerable Web App (DVWA) is a PHP/MySQL web application that is damn vulnerable.