One framework I’ve began using recently is the Kohana PHP 5 Framework.  It’s a very lightweight framework using the Model-View-Controller (MVC) pattern.  While working with the framework, I’ve found several things that I really liked over several CMS software such as Joomla! and Drupal could not provide (or not that I’ve noticed, at least).  I really like Kohana’s simple ability to allow all your scripts to sit under the public root, and be the core of several applications.

Security-wise, I like how simply it is to keep everything under the public root.  The only thing that sits on the public root is in index.php file and any client files (images, CSS, Javascript, etc.)  If the PHP parser fails and the PHP code is exposed, only the index.php is exposed to the public, and it doesn’t contain anything critical except relative paths to your main application directory, which is inaccessable publically.  Kohana has a core “system” directory, and one more or “application” directories for each of your web application.  With this type of filesystem, they’ve implemented the so-called “cascading filesystem.”  If there is anything not set in your application directory (e.g. configurations, error pages), Kohana automatically aquires those lower in the filesystem chain, with the “system” directory being at the very bottom.

Kohana provides all the abstraction libraries for common use functions, like database access, session management, caching, etc.  Additional modules also such as the Auth module for user authentication makes it simple to create and manage secure passwords and sessions.  Even without a URL rewrite module on your web server, building SEO-link friendly apps should not be an issue.

PHP itself is a very lax scripting language that lets developers do whatever they want, which can have major disadvantages when trying to create organized apps.  Having a framework like Kohana definitely helps keep many things organized.