ansaurus

Question

Running JavaScript downloaded with XMLHttpRequest

Answer 1

+1 A:

I believe the recommended solution is something like this:

function include(scriptUrl)
{
    var xmlhttp = new XMLHttpRequest();
    xmlhttp.open("GET", scriptUrl);
    xmlhttp.onreadystatechange = function()
    {
        if ((xmlhttp.status == 200) && (xmlhttp.readyState == 4))
        {
            eval(xmlhttp.responseText);
        }
    };
    xmlhttp.send();
}

Or something like it.

However, be wary of this approach. It's vulnerable to cross-site scripting, which can open you (and your users) up to all sorts of nastiness. You'll want to take suitable precautions.

Mike Hofer 2010-09-16 16:48:51

Didn't see your comment when posted. You're completely right. However I think you have to check readyState value in onreadystatechange handler like it is shown here http://www.w3schools.com/ajax/ajax_xmlhttprequest_onreadystatechange.asp.

Kirill Muzykov 2010-09-16 16:56:32

@Insomniac: Duly noted, and thanks. Post fixed! Wouldn't work very well if the stream ended in the middle of a statement now, would it?

Mike Hofer 2010-09-16 17:03:15

Kirill Muzykov 2010-09-16 17:07:54

And even better to use something like thishttp://plugins.jquery.com/project/rloader to avoid eval'ing.

Kirill Muzykov 2010-09-16 17:09:14

While I like jquery, personally, it's not suitable for every environment. I'd personally have my lips stapled to the wall if I introduced it into the product at work. So, you show folks both approaches and enjoy the benefits of increased knowledge.

Mike Hofer 2010-09-16 19:07:16

@Insomniac: You caught me again. Curses! Foiled again! :-P

Mike Hofer 2010-09-16 19:07:36

No worries, I paste unfinished code all the time, when I want to demonstrate idea :)

Kirill Muzykov 2010-09-16 20:09:34

Answer 2

A:

You would need to use eval to parse the javascript from the XHR, note that this is EXTREMELY dangerous if you don't have absolute trust in the source of the javascript.

JaredM 2010-09-16 16:50:39

Answer 3

+1 A:

You can run script downloaded in form of a string using

eval()

However I would recommend you to add new

<script src='..'></script>

to your document and have a callback which will be called when it will be downloaded. There are many utils and jquery plug-ins for that.

Kirill Muzykov 2010-09-16 16:51:11

`eval`'ing from XHR is less dangerous than injecting a `<script>` due to same-origin policies placed on XHR (which are not present with `<script>`). However, setting up `<script>` is often simpler.

strager 2010-09-16 17:33:13

I totally agree that both approaches have a security issues, but if you want dynamic script loading you don't have too much to choose from :) Also eval()'ed script are not cached and can badly affect performance if you have a big script.

Kirill Muzykov 2010-09-16 17:44:18

Answer 4

A:

You would use eval(param) and the parameter would be the response from the request. Your method of requesting for JavaScript is ridiculous as it only delays the code from running. Just use function and events.

ApocalypeX 2010-09-16 17:50:39

ansaurus

tags:

views:

answers:

Running JavaScript downloaded with XMLHttpRequest

related questions