Ajax
is JavaScript, but if you're referring to a toolkit or something please let us know which one.
I use jQuery UI's
autocomplete[
^]. It is fast, clean and easy to get running on your site. There are great examples on using it with ASP.NET MVC.
As far as security goes, that all comes down to you. If you are using POST, a lot less of an issue. If you are using HTTPS, even better. The libraries and controls themselves won't prevent you from XSS attacks and won't prevent your users from eavesdroppers. This is on you.
Cheers.