In a fight between a polar bear and a white shark, who will win ? Guess what, if this is a pool fight, the shark will munch through the bear in less than two minutes (this site makes unsubstantiated claims to the contrary, but there are strong clues that a shark eating a polar bear really happened). Now put them both on a land, and I will put my money on the bear (here is a video with a huge walrus in the same position, and it is not pretty).
This little analogy is meant to express that it depends on the situation.
If you develop your software in Java with Java code running in the client (as an applet or with Java WebStart), then most of the computing will be done on the client, which is great to make responsive interfaces and lighten the CPU burden on your servers, but also tends to require that the client is somehow trusted. This is the same issue as multi-player games: the more you delegate to the client machines, the more you give them the ability to cheat. Also, Java on the client system requires Java support to be installed, which is not hard but not a given either.
You can also make a Web site where everything happens on the server. You can do that with various languages and frameworks, including Java (that's where Tomcat becomes relevant) and PHP. That the server uses Java does not imply that the client must have Java installed (if you think otherwise then think again). It then becomes a question of "what programming language is better ?" and we know that such questions cannot be really answered. The only generic assertion that can be made is that the most secure language is that which the developer masters most. Writing a secure application requires that the developer knows all the small details of the tools he is using, because security comes from thinking about what happens in unusual conditions. Security, like maintainability and also speed, really depends on what your developers know.
