Domuk No, not an
issue with
the PHP - I
was
responding
to "AJAX not
being cross
site is
annoying"
MaxMouse Really? i
thought that
would only
be important
if the user
had some
kind of
control over
where the
XML came
from, if you
hard code it
(As in a PHP
file)
wouldn't
that
eliminate
XSS attacks?
Domuk Yes, but
very, very
necessary.
AJAX
requests run
in the
context of
the browser,
there'd be
no security
if it was
cross-domain
.
MaxMouse AJAX not
being cross
site is
annoying,
all other
scripts can
be used in
that way,
having to
resort to
PHP to patch
it is a
shame.
Copyright Open Source Institute, 2006 