What's a good web filter for a non-profit school-age PC lab?

The most important thing is to keep the PCs out in the open I think. Your technically adept high school student is likely to have the time, inclination and expertise to get around any web filtering software. You can reduce the inclination part if the computers are always visible to somebody in charge.

Take a look at http://www.palisadesys.com/products/screendoor/index.shtml. Its' probably going to be your best bet for non-labor intensive content filtering. What you get is a black box PC that you hook up on a subnet between your internal networks and your pipe to the internet using an unswitched hub. It scans the traffic going out to the net and will cancel any requests that are on its blocked list. It will work with HTTP, FTP, NNTP, etc. They've got a huge list of blocked sites, arranged by category. That allows you some discretion. When I was put in the position to have to find and recommend such a system, all I blocked were the sex sites and let most other things through. There will be some sites that are blocked when they shouldn't be, but at least with Screendoor you can edit the blocked list to rectify that. I couldn't get them to give me a human readable version of their blocked list though. And the opposite is true too. There will be porn sites that aren't blocked. When I had the system up, I was easily able to google up some hardcore porn that would come through. But the obvious ones are all covered: whitehouse.com (although before the incident that imposed this solution on me, I'd had that blocked with an ACL on the routers), playboy.com, etc. You can also use the system to control which machines can or can't use various network services, although I never implemented that. For what it is, it's a really good solution. It doesn't have any impact on network performance, as it's just scanning passively until it sees something that triggers it. And there's no need to be running from machine to machine installing buggy software.

Jay Currie runs http://www.libraryfilter.blogspot.com/ [and also, himself, sells a low-end but useful filter IF 2k] which has links to a lot of the reviews and companies. I have two personal pieces of experience with filtering companies [and mercifully we don't have to put filters on our library computers]. N2H2 has categorized my entire website as "porn" and has been ignoring my email to ask them to please more sensibly recategorize my site. Smartfilter was very nice when I asked them to recategorize my site, even though they just changed it from "chat" to something that was more approximating "college kid home page" which is still off base. I'd recommend Squid, keeping all the computers in the open, establishing an Internet use policy beforehand [to the extent that you can], training staff in how to deal with infractions and using a filter that allows you to use at least some of your own discretion when blocking and unblocking sites. Remember that CIPA only mandates blocking images, so looking for CIPA-compliance [which is a fake term anyhow, honestly] won't probably get you what you are looking for.