Web Server:
- Handles only HTTP protocol
- Consists of web container alone (Servlet/JSP)
- Code has take care of security, transaction, database connectivity and messaging
Application Server:
- Handles Multiple protocol
- Contains web container + EJB container
- Application server itself will take care of security, transaction, database connectivity, pooled data connections, data caches, session persistence, messaging and fail over protection
Explained more at
1) http://www.javaworld.com/javaqa/2002-08/01-qa-0823-appvswebserver.html?page=1
2) http://www.serverwatch.com/tutorials/article.php/10825_1355131_1/Web-Servers-vs-App-Servers-Choosing-Between-the-Two.htm