I\'m using the AcceptVerbs method detailed in Scott Gu\'s Preview 5 blog post for dealing with form entries in ASP.NET MVC:
It's like using ViewData, meaning it's probably not a security risk. But i would rather use ViewData than TempData. Check here for a comparason: http://www.squaredroot.com/2007/12/20/mvc-viewdata-vs-tempdata/
Depending on the design, you could always store the user / basket or whathever you need in the tempdata in the database and just have a "IsReady" field which indicates if its completed or not, making it extensable for later if you want to take in mind, that people can close their browsers.