The YUI's piecemeal approach appeals to engineers who want what they want and no more, Sha says. "You don't have to take the whole package. You can pick and choose what you need."

Developers should be judicious about picking the libraries they use in their applications and recognize their limits, Sha says. "If you're working with the animation library, use it for simple effects. Don't try to create a movie."

Along with new possibilities, AJAX brings hazards that are "just destroying the Web right now," Lerdorf says.

"Once you move half the application to the front end, the back end gets very simple," he says, but it also takes away control because that front-end code is released onto the Internet, where hackers can manipulate it. "So you have to ask yourself, what could they send us to trip us up? The answer is, a lot."

Defending against such attacks is not easy, particularly for startups too busy creating applications and going after market acceptance to worry about security, Lerdorf says. "When the news hits that they're about to be bought by Yahoo or Google, the hackers descend in droves."