That would tell you how stable PHP is on IIS. In regards to security, I would say that it's better to run PHP as a module rather than as a CGI. If you put these two replies together, you may well notice that it's probably best not to run PHP on IIS. Although not as secure as when run on a *nix system, Apache on an NTFS system (ie NT, 2000, XP) is supposed to be fairly secure.