Is learning basic web security difficult? Where should one start

The best advice I can give is to start with security practices available within a language and work backwards from there. Most security issues come from a hole in the security of the language or poor programming, allowing exploits.

.

OWASP. thank me later.

@magicMirror came here to say the exact same thing