I have been told its kind of a bad idea to use a key as an attribute of an xml tag. I find the very handy for ajax as i can just stick the key i need in what ever element is being clicked,changed, or whatever. I can see how this is a security risk but have only used the tactic in internal apps.
On external application/sites what would be a better way to handle this. I would assume just embedding another unique field that isn't numeric.
Basic example... I have a button than when pressed would update the price of an item in the database. Then using JS on button press i would take the id and pass it back to the controller to update the item.