SSH keys instead of plain passwords, CF as a web proxy, don't ever trust user input if you're coding something on your own - always escape any characters, any suspiciously looking shit.
Yes, that would do the trick, also tested. However, you can find yourself having a duplicate topic title at one moment. What then? That's why the IDs are in place.