ShippMA,
When discussing asp vs php, you could look at availabilty of hosting sites as one point, I had a lot of trouble finding somewhere that would host asp pages.

Also you could mention scalablility, when discusing why you ruled out access. I seem to remember trying to use access for something like a full outer join query or something like that and it failing. I just remember it not being conistent with msSQL server.

I agree with ammo about the stored proceedures, make sure the users don't inject SQL commands into any input to your interface that can reach the DB as part of a command.

When looking at holes not plugged, you could include some kind of response time analysis of the develeopers of the various systems to holes and how frequently these holes appear. I suspect it may support your choice .

Waverebel