Thanks for the quick reply. I am not completely in charge of the CMS decision, but I'm not done pushing.
VR,
Neal S.

Here's something that you might find interesting.

We recently (within the last few years) converted a DNN website to Concrete5. It was a movie theater and they used user accounts to maintain newsletter signup lists. When we were asked if we could bring over all these users our first thought was, well probably but we'll have to leave the old users table intact to rehash the passwords. However, after a little bit further investigation we found that DNN uses encryption for their password storage, not one way hashes. I was shocked by this, within a matter of about 30 minutes I had decrypted about 10,000 user account passwords from the database. To me, that does NOT say secure. Granted, one would first have to get access to the db, but this still seems like horrible practice to me. Couldn't tell you if they've changed this behavior in newer versions of DNN or not.

That said, PHP vs C# I would say isn't any more or less secure, they all have dependencies that are prone to vulnerabilities and no programmer is perfect when using the language so sometimes vulnerabilities happen to do oversight or ignorance as well. I'd advise to stick with what you know unless you have a really really good reason to change (other than "security").