Is there any security consideration with webform and Salesforce API?
PHP SOAP will not introduce any security issues in itself; it's more about how it is used. If it's used via unencrypted HTTP, for example, the data could be intercepted, like any other data. If you need the data to remain secure, then obviously this would be a consideration.