I would choose my language not on raw numbers first, but on your functional requirements. If after analyzing your functional requirements you do not have a clear winner, consider the following points:

(Disclaimer: I develop in PHP but have used JSP from time to time)

Future-proof

None of both platforms will disappear soon. As for each major versions of each platforms, they might come with some changes that will break your code. (Or at least deprecate a bunch of methods)

Performance

I could link to benchmarks showing PHP to be faster and others showing JSP to be faster. It depends on your hardware and what you plan on doing with it. For pure number crushing, JSP seems to be faster.

Security

PHP has a bad reputation security-wise and I can understand why. There are a lot of students and hobbyists who started coding in PHP and have absolutely no idea of what code security means. Please remember that this affects their code, not yours. Also, if you choose PHP, be careful when choosing third-party documentation. A lot of them a written without any consideration for code security and their examples are riddled with security issues (especially the database section of such books).

There are equal opportunity to shoot yourself in the foot in JSP than in PHP. There is nothing stopping me from writing the following code in JSP:

// DON'T DO THIS
String query = "SELECT * FROM Employees WHERE EmployeeName = '" 
                   + employeeName + "'";

Statement statement = connection.createStatement();
ResultSet rs = statement.executeQuery(query);

as there is nothing stopping me from doing the same in PHP:

// DON'T DO THIS
$statement = "SELECT * FROM Employees WHERE EmployeeName = '"
             . $employeeName . "'";
$result = mysql_query($statement, $connection);

Yet we all know that we should never do anything as such in our code.

Whatever language you choose, follow these simple security rules. Those are applicable on all platforms.

• Use parametrized queries
  JDBC has built in support for them. If you are using PHP, drop php_mysql and use the php_mysqli extension instead (or even better, PHP Data Objects) which has support for parametrized queries.

• Never trust user input
  Never trust user input, even input that isn't meant to be changeable. Learn to expect unexpected values like \n in <input> fields or values which are not even part of your <select> and deal with them accordingly.

• Validate, validate, validate
  Always validate your data. If your data has been validated in a previous step, validate it again. User can't get to this page without logging-in? Validate his login information on page load. Ties in with the rule above.

• Escape, escape, escape
  Always escape your HTML output to prevent most XSS attacks. Even if that field is only supposed to carry a number. Creating a file based on user input? Escape and validate the file name. Passing to a CLI application? Escape your shell arguments. Not using parametrized queries (rule 1)? At least escape any and all input.

• Follow best practices, not common practices
  And in PHP's case, best practices can be in total discord with common practices. Learn to differentiate between the two. Turn off magic_quotes, don't use addslashes() for security purposes, etc...

• Protect sensitive information
  Don't store plain-text passwords in the database. If you need the original value, encrypt. Most of the times you won't, so hash. Also, you really don't need to fetch that SSN value from the Employee table if you are displaying a directory of employees for phone purposes. Sensitive pages on your website should be protected behind a login page.