A friend of mine just told me this:

For security in a webbrowser, there's only Java or Flash.

I really strongly doubt that, and I'm pretty sur that there's no difference between a Website (properly written) in Php and a Java app embedded in a Webbrower.

Is he right, and if so, what are the main differences (*only* from a security point of view, don't start talking about memory consumption and son on, please...)?