how much would winnt/2k cost? and, is it command-line?

ntsa, if I understand you correctly, you're saying not to give them full cgi access? well i guess if they really wanted to use cgi, they could use their isp's webspace or a remotely hosted one.

i think instead of trying to secure my box, i'll just forget the idea of givin them full cgi access.