PHP + Ajax

[dclamp]

i am looking at adding ajax to my site, and i just wanted to know how safe it would be to add it. Is there any security risks in using it?

also, does anyone know of any good examples?

[StrangerInBeijing]

Other than making your site javascript dependent (which it probably already is), nothing else change.
Just now javascript will use a xmlhttprequest to get a php function running, and let another function handle things when the function did a job.
Nothing to do with security, unless you already have security problems.

There are tons of examples on how to use ajax.

I suggest you learn how to make an xhtmlhttprequest, and how to work with it (you will need to know some javascript and dom).
Here's the xmlHttp.js file I use for working with that. Guess it wont make much sense at this stage.
var request = null;
/* nn-Wrapper function for constructing a request object
Parameters:
reqType: The HTTP request type, such as GET or POST
url: The url of the server program
asynch: Whether to send the data asynchronously or not
respHandle: The name of the function that will handle the response
Any 5th parameters, represented as arguments[4] are the data a
POST request is designed to send */
function httpRequest(reqType,url,asynch,respHandle) {
//create the XMLHttpRequest Object
request = createXmlHttpRequestObject(); // call to custom createXmlHttpRequestObject function
//allthough unlikely, make sure the XMLHttpRequest object have been created
if (request) {
if(reqType.toLowerCase() == "post") {
//if the request type is POST the 5th parameter is the POST data ;
var args = arguments[4];
if (args != null && args.length > 0) {
initRequest(reqType,url,asynch,respHandle,args) //call to custom initRequest function
}
} else {
initRequest(reqType,url,asynch,respHandle); //call to custom initRequest function
}
} else {
alert("Your browser does not permit the use of all of this application's features!");
}
}

/* nn-Function to create XHLHttpRequest object
Will create an object most suitable for current browser */
function createXmlHttpRequestObject()
{
// will store the reference to the XMLHttpRequest object
var xmlHttp;
// this should work for all browsers except IE6 and older
try
{
// try to create XMLHttpRequest object
xmlHttp = new XMLHttpRequest();
}
catch(e)
{
// assume IE6 or older
var XmlHttpVersions = new Array('MSXML2.XMLHTTP.6.0', 'MSXML2.XMLHTTP.5.0',
'MSXML2.XMLHTTP.4.0', 'MSXML2.XMLHTTP.3.0',
'MSXML2.XMLHTTP', 'Microsoft.XMLHTTP');
// try every prog id until one works
for (var i=0; i<XmlHttpVersions.length && !xmlHttp; i++)
{
try
{
// try to create XMLHttpRequest object
xmlHttp = new ActiveXObject(XmlHttpVersions[i]);
}
catch (e) {} // ignore potential error
}
}
// return the created object only if created
if (xmlHttp)
return xmlHttp;
}

/* nn-Initialize an allready constructed XMLHttpRequestObject
Parameters:
reqType: The HTTP request type, such as GET or POST
url: The url of the server program
asynch: Whether to send the data asynchronously or not
respHandle: The name of the function that will handle the response
Any 5th parameters, represented as arguments[4] are the data a
POST request is designed to send */
function initRequest(reqType,url,asynch,respHandle) {
try {
/*specify the function that will handle the HTTP response*/
request.onreadystatechange = respHandle;
request.open(reqType,url,asynch);
if(reqType.toLowerCase() == "post") {
//if the request type is POST the 5th parameter is the POST data
request.setRequestHeader("Content-Type", "application/x-www-form-urlencoded; charset=UTF-8");
request.send(arguments[4]);
} else {
request.send(null);
}
} catch (err) {
alert("The application cannot contact the server at the moment.\n " +
"Please try again in a few seconds.\n" +
"Error Details: " + er.message);
}
}

[penagate]

AJAX should not make a site JavaScript-dependent. All scripting should enhance the site's functionality, not add to it. Make it work without any scripting, then enhance it using JavaScript.

[StrangerInBeijing]

AJAX should not make a site JavaScript-dependent. All scripting should enhance the site's functionality, not add to it. Make it work without any scripting, then enhance it using JavaScript.
Yeah, but I ain't that good, and this mate is even behind me.
Why don't you give us an example?

[dclamp]

i have seen ajax in use on another forum, and i like it, it really makes it faster for the client. I would love to implement it on my site, if it is worth doing.

[McCain]

Yes, ajax is worth learning. My suggestion is to learn how it works using raw calls to the server. When you understands how that work you should move on to some library that has implemented all the low level stuff and gives you a higher abstraction layer to work with.

[dclamp]

i started taking tutorials on VTC.com and they have helped a little