I'm in a process of selecting a distro which will be a LAMP+e-mail server for a shared hosting for a number of years (minimum upgrading, stable as possible). What is the current state of Debian and Centos regarding 3-rd party repositories with standard lamp stack: apache with modules for everything, php with various features (hardened, patched etc.), various mysql versions etc...
I don't want the latest and greatest versions of everything, but maximum stability and security. Maybe the standard bundled versions would suffice? (I need PHP5, though).

Don't turn it into a distro war, I am quite familiar with both of them (started my career with Debian 1.3, and for the past few years used Centos4/5 almost exclusively (but not for LAMP)).

"Both of them"??? There are FAR more than two.

But if you want long-term stability, go with a distro that's aimed towards servers, with a long life span. RedHat Enterprise, SuSE Enterprise, and CentOS spring to mind. Think the open versions (Fedora Core), versus RedHat Enterprise, or openSUSE versus SuSE Enterprise. Versions update slowly for 'server' distros, more often for 'open'. If you want good security and stability, you need to pay for it, in my opinion.

Not that CentOS (or any), version of Linux is insecure, but the enterprise players have more to lose. If RedHat or SuSE become aware of a security hole, you better believe they patch it as quickly as they can, and have also TESTED that patch with everything they can find. They don't want to lose a big customer by dragging their feet. The 'open' versions patch quickly too, but there's no guarantees things will be tested with what YOU run...so by fixing one problem, you may uncover another.

Debain, Suse, RHEL BSD take your pick

almost any long life distro will do
( fedora is NOT an long life)

Of course there are lots of them, but I narrowed it down to Centos and/or Debian Stable... Fedora and such are out of the question. Suse SLES costs money and that is, unfortunately out of the question (let's say I volunteer in setting this up).
My question was more oriented towards LAMP repository quality (like DOTDEB Vs. REMI). I had some dependency problems a while ago with Remi, I almost had to reinstall everything. Haven't used Dotdeb in a while...

what is wrong with CentOSPlus or RPMForge
( use one or the other -- NOT BOTH )

http://wiki.centos.org/AdditionalResources/Repositories