Differences

This shows you the differences between two versions of the page.

--- eg-259:lecture12 [2012/03/07 07:49] – [Narrowing the Gap] eechris
+++ eg-259:lecture12 [2012/03/07 08:06] (current) – [What's Next?] eechris
@@ Line 109: / Line 109: @@
   * Standards-based presentation using XHTML and CSS;
   * Dynamic display and interaction using the Document Object Model;
-  * Data interchange and manipulation using XML and XSLT;
+  * Data interchange and manipulation using JSON, XML and XSLT;
   * Asynchronous data retrieval using ''XMLHttpRequest''; and
   * JavaScript binding everything together.
@@ Line 185: / Line 185: @@
   * Relies on the non-standard ''XMLHttpRequest''((''XMLHttpRequest'', Wikipedia, the free encyclopedia. URL: [[wp>XMLHttpRequest]].)) object introduced by Microsoft as an ActiveX control for Internet Explorer/Windows.
   * Available on most modern browsers, and being standardized by W3C((The ''XMLHttpRequest'' Object, W3C Working Draft, 27 September 2006, URL: http://www.w3.org/TR/XMLHttpRequest/)) but expect some variation between browser implementations
-  * ''XMLHttpRequest'' is an API that can be used by JavaScript, JScript, VBScript and other web browser scripting languages to transfer and manipulate XML data to and from a web server using HTTP, establishing an independent connection channel between a web page's Client-Side and Server-Side.
   * The data returned from ''XMLHttpRequest'' calls will often be provided by back-end databases. Besides XML, ''XMLHttpRequest'' can be used to fetch data in other formats, e.g. JSON or even plain text.
+----
+<note>
+''XMLHttpRequest'' is an API that can be used by JavaScript, JScript, VBScript and other web browser scripting languages to transfer and manipulate XML data to and from a web server using HTTP, establishing an independent connection channel between a web page's Client-Side and Server-Side.
+</note>
@@ Line 194: / Line 197: @@
   * By default ''XMLHttpRequest'' returns XML
-    * This can be manipulated as if it was a DOM object or further transformed with XSLT
+    * This can be manipulated as if it was a DOM object or further transformed with XSLT((You don't see many examples of Web data being manipulated in this way))
   * It can also return a directly parsable text format called JSON((JSON, Wikipedia, Wikipedia, the free encyclopedia. URL: [[wp>JSON]].))
-    * JSON (pronounced like the English given name Jason), which stands for "JavaScript Object Notation", is a lightweight computer data interchange format.
-    * JSON is a subset of the object literal notation of JavaScript but its use does not require JavaScript.
 ----
+<note>JSON (pronounced like the English given name Jason), which stands for "JavaScript Object Notation", is a lightweight computer data interchange format. JSON is a subset of the object literal notation of JavaScript but its use does not require JavaScript.
+</note>
 JSON is based on a subset of the JavaScript Programming Language. The format is specified in [[http://www.faqs.org/rfcs/rfc4627.html|RFC 4627]]. The official MIME Media Type for JSON is ''application/json''.
@@ Line 313: / Line 317: @@
 The first parameter of the call to ''open()'' is the HTTP request method -- ''GET'', ''POST'', ''HEAD'' or any other method you want to use and that is supported by your server. Keep the method capitalized as per the HTTP standard; otherwise some browsers (like Firefox) might not process the request. For more information on the possible HTTP request methods you can check the W3C specs.
-The second parameter is the URL of the page you're requesting. As a security feature, you cannot call pages on 3rd-party domains. Be sure to use the exact domain name on all of your pages or you will get a 'permission denied' error when you call ''open()''. A common pitfall is accessing your site by //domain.tld//, but attempting to call pages with //%%www.domain.tld%%//.
+The second parameter is the URL of the resource you're requesting.
+<note warn>
+You cannot access resources from 3rd-party domains. This is called cross site scripting (XSS) [[wp>Cross-site_scripting]] and is not allowed as a security feature. Be sure to use the exact domain name on all of your pages or you will get a 'permission denied' error when you call ''open()''. A common mistake is accessing your site by //domain.tld//, but attempting to get resources with //%%www.domain.tld%%//.
+</note>
 The third parameter sets whether the request is asynchronous. If ''TRUE'', the execution of the JavaScript function will continue while the response of the server has not yet arrived. This is the A in AJAX.
@@ Line 327: / Line 335: @@
 Otherwise, the server will discard the POSTed data.
 ===== Step 2: Handling the Server Response =====
@@ Line 580: / Line 587: @@
   * Mapping resources to files
-[[eg-259:ch15|Previous Lecture]] | [[eg-259:home]] | [[eg-259:lecture14|Next Lecture]]
+[[eg-259:ch15|Previous Session]] | [[eg-259:home]] | [[eg-259:lecture14|Next Session]]