I have some serious difficulies with your company's development / testing / production staging environment. You state that:

development will occur on a Win2K box running Apache and using taint checking. Once unit testing is complete, the scripts will be moved to an identical staging server using IIS and ISAPI

Sorry, but having such significantly different environments between development / testing and production (including a different server api) negates much of your whole testing strategy. In all of the applications development I have managed, I have made sure the environments match - even to software versions.

The bottom line - can you really have confidence that the difference in your environments can be covered?