JavaScript 2.0-The Complete Reference, Second ... - freecodingtutorial

Figure 19-1: Unlikely news from JavaScript Ref’s authors
While it‘s clear you could achieve a similar effect using meta-refreshes or JavaScript redirects,
the dynamic content approach doesn‘t require reloading the page and allows you to update
multiple content areas independently from different sources. You just need to be careful to keep
your naming consistent so the scripts returned by the server can access the appropriate parts
of the page.
Note Those familiar with JavaScript’s same origin policy (Chapter 22) might wonder if this
technique would work if the RPC is made to a server other than that from which the
document was fetched. The answer is yes, because externally linked scripts are not
subject to the same origin policy.
Cross-Site Scripting
You need to be extremely careful to avoid cross-site scripting vulnerabilities when implementing
dynamic content fetching. Chapter 22 has more information, but the basic idea is that if your
server-side script takes query parameters and then writes them back out in the response
without escaping them, an attacker could pass JavaScript in the URL, which would then be
executed by the browser in the context of your site. For example, an attacker could construct a
URL that includes JavaScript to steal users‘ cookies and then send spam out.
Server-Side Computation
The dynamic content approach isn‘t limited to fetching content; you can use it to carry out
server-side computation that would be impossible (or at least very inconvenient) to do with
JavaScript. As an example, suppose you wished to provide a spelling correction feature for a
on your page. To include a dictionary and spelling-correction code in your script
would be unwieldy at best, so the feature is better implemented via RPC to a server.
The following example illustrates the basic concept. To keep things simple, this script only
checks a single word entered in an , but you could extend it to check an entire
. Notice how we use a variable to signal that the RPC is complete.