views:

79

answers:

1

how to stop evaluating script tags in jquery ajax and post responses? Please find the corresponding code below.The function sendForm() is being evaluated even when i am using dataType : 'text'

<HTML>
 <HEAD>
 <TITLE>This is the title</TITLE> 
<script src="http://ajax.googleapis.com/ajax/libs/jquery/1.4.1/jquery.min.js" type="text/javascript"></script> 
<SCRIPT> 
function get_info(url,data,callback,errorFunction)
{  
 $.ajax({ type: 'POST',   url: url,   data: data,   success: callback,   dataType: 'text',   error: errorFunction,   cache : false });
} 
</SCRIPT> 
</HEAD>
<BODY>
<A NAME="this"></A> <A HREF="#this" ONCLICK="get_info('Result1.lasso','temp=1&testParam=Rajesh',function(response){$(document.getElementById('test')).html(response);},function(){$(document.getElementById('test')).html('Error');})">Some Text</A> 
<DIV id = 'test'></DIV>
</BODY>
</HTML>

Result1.Lasso

<script type="text/javascript">
    function sendForm()
    {   
        alert('hi');
    }
</script>
<form name= "abc" method = "get" action = "abcd.lasso">
    <input type ="text" name = "element1"/>
    <input type = "button" value="Click" onClick = "javascript: sendForm();"/>
</form>
+1  A: 

The best I can tell the reason the script is being executed is because of this line of code:

$(document.getElementById('test')).html(response)

Since you are adding it in as html you are adding all html elements including script. If you change html() to text() you will NOT execute javascript, but I don't think it will look how you are wanting it to work.

My best suggestion is to use javascript string functions to pull any javascript out of the response string before adding it. This is an okay solution if you have control over the .lasso. If you don't some security issues could occur if your javascript searching is bad.

sammcd