I'm a newbie in Java and still lurking arround etc. but as far as it goes for PHP i can fix your latest ACM and make it run with AJAX... as it goes for security if you make file names "lallala.inc.php" and set Apache to not show ".inc" extension to any queries made even linux wget and yes wget will pull your PHP source from server(easiest way of stealing websites). AJAX is a very good thing for any website and is not used a lot since people think it's unsafe etc. But it's really just as unsafe as any other HTTP Request. The biggest addition of AJAX is that it cuts down traffic by 90%
Need any help just ask :)