Speaking of security risks, how about this line:

_topic = new String(request.chktopic);

...

var sql="!nocache:execsp usp_setcontacttopic "

... + ", '" + _topic + "'";

That's a great way to leave your site open to SQL Injection attacks!