I'm doing a webpage for someone which uses php to link to a Filemaker DB. The whole thing works great on any OSX computer that I've set it up on. The page has a form which uses FMandPHP to send the data to FMPro. My client has a small office network which revolves around Filemaker Pro databases. There's an old mac there which I've set the webpage up on, and all works well, but I'm worried about security.

I don't know that much about security, and I'm wondering if it'd be easier to use some sort of web hosting service, and just serve the FMPro DB from my clients office. This way, people on the web will have no idea what the IP address of my clients office is at all.

Is this overkill? What sort of hardware/software firewall would you recommend as a minimum for webhosting? My clients intranet doesn't have the best internal security as it is, so I'm thinking it'd be best not to tempt the devil by advertising its IP address to the world.

If you'd go with a web hosting service, who have you used? Which ones are good value etc. (remember that they have to have php)