What framework you recomend for fast secure web application development?

Question

I need to choose a framework for a new project I will start from scratch. The application performance requirements are very low. It needs to allow fast development and enforce good development practices. The final application should be easy to deploy and handle well database migrations.

The application will handle most of the time simple CRUD operations for a specific domain. It needs to be very secure. In the long term I will need to certify it's security. I have experience programming in PHP and now I am working as a Java developer.

The language for the framework is not important as long as it meets the requirements stated above. Thanks in advance for your answers.

Answer 1

For PHP, I've used Zend Framework, CodeIgnitor, and CakePHP (only maintenance of an existing CakePHP project briefly).

Zend was huge. It had a lot of functionality, and I liked how you didn't have to follow it's MVC pattern (good for existing projects, but probably doesn't apply to you). However, I would only recommend it for large projects. If it's small, Zend is overkill.

CodeIgnitor was good, very Rails like. I didn't use it for long, as the project was handed off to another team, though, along with the CakePHP project.

Answer 2

Having started with php and recently switched to rails, I must say that rails certainly enforces "best practices". The rails moniker is not an accident. It follows a strict Model-View-Controller paradigm, making it easy to do the right thing. There's a lot of stuff already done that you probably always planned to do but never came around to, like an easy way to switch between production/development/testing environments, each of which has it's own characteristics (i. e. in testing and development, emails are not send out but logged). The migrations infrastructure makes deployments of changed models (database structures) quite easy.

None of these ideas are impossible to replicate in other frameworks, and I assume many of them have already done that. But overall there's a level of completeness and attention to detail that I had not seen before. Ruby, the language, needs some getting used to, but it is quite elegant compared to php.

Regarding security, that's probably mostly your job. Sanitizing input etc. Rails has some nuild in mechanisms to help you with it, but so does any other framework out there, I assume.

Answer 3

@Matt Winkelmann: I like Rails, myself, but support for it on shared hosting is lacking, but the community behind it is growing. I don't think it's quite ready for prime-time yet, but it's moving closer very quickly.

Answer 4

I suggest ASP.NET with the MVC framework. Use NHibernate/Castle ActiveRecord for data access. This would imply a Windows server, which has a lot of baked in authentication/authorization schemes.

Answer 5

If you wanted to stick with Java, I'd recommend taking a look at Tapestry.

To get an overview of all the Java world options, there's quite a very overview of the two major camps and the different options from one of the JSF guys (Kito Mann) at about 8:40 in episode 203 of the Java Posse.

Answer 6

Django is the way to go. You can even host your killer application here!

Answer 7

A friend also recommended choosing ruby on rails. I think will go this way. Regarding server configuration I have complete freedom so I can meet any framework requirements.

@Alexander I have searched SO before posting the question. The question about php frameworks was a bit too specific for me.

Thank you for the quick answers.