Question: I am deciding on a framework to try out for PHP. I have narrowed it down to CakePHP and CodeIgniter. I have a couple of questions for any of you who have used or are familiar with both:

1. I like the fact that CakePHP keeps most of the code outside of the webroot by default. Especially since I may end up using a single framework install for multiple apps. I see CodeIgniter will do that too, but you have to configure it and move some stuff around. Is that workaround secure and reliable, or is it an afterthought hack?
2. Which (if not both) is easier to upgrade, and maintain over the long term? As new versions of the framework (and PHP itself) come out. I don't want to find my stuff either breaking, or becoming outdated.

**Edit:**

This is a very old post, but I thought I would update it with what I finally ended up doing, which was to use Kohana.

Answer: 
1. is a non-issue.
2. CodeIgniter has a sponsor behind it, so it's definately the one to choose for the long term. Also, it's faster.
To address both of your questions from a CodeIgniter perspective (I don't use Cake):

1) CodeIgniter doesn't keep itself outside the webroot by default, but it can do so with some very simple changes. The first part of [my CI tutorial series](http://www.jimohalloran.com/2007/09/10/building-a-complete-codeigniter-application-part-1/) explains how to do so, along with a walk through of the setup of a new CI instance. Once finished the only part of CI that needs to be in the webroot is a small index.php bootstrap file.

2) I've got an application which I originally developed in CI 1.4.x and I've sucessfully migrated to 1.5.x then 1.6.x. With each new release the CI dev's make available detailed upgrade instructions laying out what needs to be replaced so upgrades are fairly easy.

Jim.