Re: [Webware-discuss] Use JavaScript with Caution...

[Aaron Held]

I agree with the sentiment, but using _javascript_ in the manner that we are discussing has allowed me to mimic much of the functionnality of traditional clients over the web.  For wexample I have a complex search system athat was migrated from MS Access.  It is usable w/o _javascript_, but much more tedious - mainly becuase the users are 'trained' on the existing system.

Also for Intranet / Extranet situations it is perfectly accectable to mave a min system requirement.  My current system Requires IE, but everything I am coding will also work with  Netscape/Mozaill,  Opera and Konqurer, but If I go with this XMLHTTP then my next project will only support Netscape / IE. 

My customers take less of a security risk this way then if they have to install a full client on thier PC's.

_javascript_ is not the bane of poor web design, poor web designers are the bane of _javascript_.

-Aaron

Chad Walstrom wrote:

Aaron Held wrote:
  

So instead of processing the return xml file, building _javascript_ 
objects and coding a result you just call the 
    

As nifty as this might seem, _javascript_ is IMHO the bane of poor web
design.  _javascript_ is meant for eye-candy, and should only be used in
that manner.  We all know that the behavior of _javascript_ is not
standardized, and depending on the browser or user preferences,
_javascript_ will not behave in the same manner and may not even exist.

How many sites have you visited in the past and present that are IE-only
or Mozilla-only.  Far fewer of the latter than the former, but generally
speaking, _javascript_ limits the usefulness of any website.

With that in mind as a note of caution, please consider maintaining
functionality for basic web browsers and those people who do not allow
_javascript_ to run for security reasons (like myself).  Program to the
least-common denominator.

Another note of caution: NEVER trust the client.  IOW, ALWAYS validate
the client response and be aware of the impact of passing values to
method calls.  A common mistake is to use _javascript_ to validate forms
before submission, and to trust that data as "clean".  _javascript_ is a
nice convenience for the user, but that is all.  The data you receive
at the server could have easily been custom scripted to exploit your
application.  Without validation and filtering, your app could be open
to all kinds of nasties.

Sorry about the preachiness, but _javascript_ is one of my largest
pet-peeves.  It can be used to create some neat web-effects and
conveniences, but it's just not safe to rely upon.