pass javascript in xmlHttp.responseText

[trpost]

Is it possible to execute javascript as passed in xmlHttp.responseText

Here is what I am doing:

search.js

var xmlHttp
xmlHttp=GetXmlHttpObject()
var url="search.php"
xmlHttp.onreadystatechange=stateChanged
xmlHttp.open("GET",url,true)
xmlHttp.send(null)

function stateChanged()
{

if (xmlHttp.readyState==4 || xmlHttp.readyState=="complete")
{
document.getElementById("search").innerHTML=xmlHttp.responseText;
}

}

function GetXmlHttpObject()
{

var xmlHttp=null;

try
{
// Firefox, Opera 8.0+, Safari
xmlHttp=new XMLHttpRequest();
}

catch (e)
{
// Internet Explorer
try
{
xmlHttp=new ActiveXObject("Msxml2.XMLHTTP");
}
catch (e)
{
xmlHttp=new ActiveXObject("Microsoft.XMLHTTP");
}
}
return xmlHttp;

search.php
<script type="text/javascript">
alert("hi");
</script>
<?php echo "hi"; ?>

test.php
<script src="search.js"></script>
<div id=livesearch></div>

So what I see when I browse to test.php is 'hi' printed to the
browser, but I would also expect to have the javascript alert executed

If I visit search.php then I get 'hi' printed to the browser and the
alert message

So it seems that when I pass the response to the span the javascript
alert is ignored
(document.getElementById("search").innerHTML=xmlHttp.responseText

Sp my question is how can I have javascript be passed and executed?

Thanks!

 

[slebetman]

Is it possible to execute javascript as passed in xmlHttp.responseText
<snip>
Sp my question is how can I have javascript be passed and executed?

// One way is to manually find all new script tags and eval them:

var searchElement = document.getElementById("search");
searchElement.innerHTML=xmlHttp.responseText;
var scripts = searchElement.getElementsByTagName('script');
for (var i=0;i<scripts.length;i++) {
eval(scripts.innerHTML);
}

 

[David Mark]

Is it possible to execute javascript as passed in xmlHttp.responseText

Yes. Even easier with responseXML.

Here is what I am doing:

search.js

var xmlHttp
xmlHttp=GetXmlHttpObject()

Is that a constructor?

var url="search.php"
xmlHttp.onreadystatechange=stateChanged
xmlHttp.open("GET",url,true)
xmlHttp.send(null)

Is your semicolon key broken?

function stateChanged()
{

if (xmlHttp.readyState==4 || xmlHttp.readyState=="complete")

Lose that second test.

{
        document.getElementById("search").innerHTML=xmlHttp.responseText;

Here is the problem. You could feature test the innerHTML property to
see if it will evaluate inline scripts, but IIRC, using standard DOM
methods (e.g. appendChild) avoids this problem altogether.

Alternatively, when you send your Ajax request, include a header to
indicate to the test.php script that it should send the document as
XHTML (with text/xml as the MIME type, IIRC.) Then you can import the
nodes as needed (even in IE.)

}
}

function GetXmlHttpObject()

Not a constructor.

{

var xmlHttp=null;

try
{
        // Firefox, Opera 8.0+, Safari

And IE7, but slightly crippled.

        xmlHttp=new XMLHttpRequest();

}

catch (e)

Using try-catch in lieu of feature detection is not a good strategy.

{
        // Internet Explorer

And anything else that failed above.

        try
        {
                xmlHttp=new ActiveXObject("Msxml2.XMLHTTP");
        }
        catch (e)
        {
                xmlHttp=new ActiveXObject("Microsoft.XMLHTTP");
        }}

return xmlHttp;

search.php
<script type="text/javascript">
     alert("hi");
</script>
<?php echo "hi"; ?>

test.php
<script src="search.js"></script>
<div id=livesearch></div>

So what I see when I browse to test.php is 'hi' printed to the
browser, but I would also expect to have the javascript alert executed

Setting the innerHTML property does not execute the inline scripts in
IE (as well as other agents, IIRC.)

If I visit search.php then I get 'hi' printed to the browser and the
alert message

As expected.

So it seems that when I pass the response to the span the javascript

When you set the innerHTML property of the div.

alert is ignored

Right.

[snip]