• (disco)

    ... And somehow.... Unicorns? First time viewing an article from home, and now I have the sparklies! Actually, come to think of it, clicking them enough eventually renders the page to a very close approximation of what a "bad old days" page would have looked like.....


    Filed under: <abbr title="function XHR() { if ( global.XMLHttpRequest ) {
    // return standards XHR object return new global.XMLHttpRequest(); }
    // return IE XHR object return new global.ActiveXObject("Microsoft.XMLHTTP");};">Make a request, if you dare...

    Edit: Wow, baked posts mess with the Title attribute...

  • (disco)

    Ooh. I can tell this one's gonna be a good one just by looking at the title.

  • (disco)

    Gah! Using escape() for query string parameters!

    I have exorcised almost all of those from the legacy codebase after complaints that accented characters weren't working properly.

  • (disco)

    A while back I spent a few hours trying to figure out how to request a JSON payload in JavaScript. Everything I tried was blocked for security reasons, and to this day I still don't know how they make HTML5 multiplayer games that work in the same browser that blocked everything I tried. Obviously, I'm doing it wrong, but the amount of Googling and reading I did for no success was insane.

  • (disco)

    I feel this is warranted:

    http://blakesnow.com/wp-content/uploads/sites/2/2013/10/url-1.gif

    I agree with Remy. As much as this should make my nose bleed... that's just fucking amazing!

  • (disco)

    Yeah, that's what (kind of) AJAX before XMLHTTPRequest looked like. Not a WTF in the usual sense, but of course something that should be rewritten.

  • (disco)

    Given the use of short object notation instead of the older long version, or even arrays, I'm doubting the age of this code. It looks like a creative method of someone who didn't realise that Javascript can now make these kinds of requests, and just tried to do it the old way that they were used to.

  • (disco) in reply to LB_

    I had a lot of fun with this, because of same-origin policy. AFAIK there are two main solutions: JSONP (don't like it very much) and CORS (way better, but not supported for old browsers).

  • (disco) in reply to Zemm
    Zemm:
    Gah! Using `escape()` for query string parameters!

    I have exorcised almost all of those from the legacy codebase after complaints that accented characters weren't working properly.

    Wouldn't the other side decode any escaped characters or did that codebase manage to do it twice?

    EDIT: Oh wait, escape() is deprecated, most likely due to non-Unicode behaviour.

  • (disco) in reply to JBert
    JBert:
    Zemm:
    Gah! Using `escape()` for query string parameters!

    I have exorcised almost all of those from the legacy codebase after complaints that accented characters weren't working properly.

    Wouldn't the other side decode any escaped characters or did that codebase manage to do it twice?
    I'd guess he was getting munched by differences in character set encoding on different browsers / OSes. (1252 versus UTF-8 versus chicken entrails versus unicorn farts)
  • (disco)

    Where's the Easy Reader Version?

  • (disco) in reply to Vault_Dweller

    It's the title.

  • (disco) in reply to Steve_The_Cynic
    Steve_The_Cynic:
    I'd guess he was getting munched by differences in character set encoding on different browsers / OSes.
    I thought `escape()` uses ISO-8859-1 if possible otherwise UTF-16, so for instance `escape("£")` is `"%A3"` while `escape("😁")` is `"%uD83D%uDE01"`.
  • (disco)

    Only one wayI can react to this post:

    https://www.youtube.com/watch?v=zRO2VUXQTAI

  • (disco) in reply to ammoQ
    ammoQ:
    Yeah, that's what (kind of) AJAX before XMLHTTPRequest looked like. Not a WTF in the usual sense, but of course something that should be rewritten.

    If your developers were retards, yes.

    If your developers weren't, you'd write a script tag to the DOM and have your back-end generate a quick and dirty JavaScript that put the data you wanted into the window namespace, where you could then read it back out at your convenience.

    Almost exactly how JSONP still works now, BTW. That worked back in IE 5 and probably earlier.

  • (disco)

    I'm sorry, I'm mad about it. My head hurts, because I hit it on my desk (several times) and so I'm mad.

  • (disco) in reply to Ashley_Sheridan

    Could be that part was changed or updated but they left well enough alone on the big picture.

  • (disco) in reply to blakeyrat

    Not everything can be solved that way. What if it's looking at a huge amount of data? What if it's sensitive data?

  • (disco) in reply to vita10gy
    vita10gy:
    Not everything can be solved that way.

    OMG say it ain't so!!!!!

    vita10gy:
    What if it's looking at a huge amount of data?

    It's a big JavaScript file?

    vita10gy:
    What if it's sensitive data?

    It's a big JavaScript file being served over HTTPS?

  • (disco) in reply to vita10gy

    What if you're working on an embedded device with no file system?

  • (disco) in reply to DCRoss

    Then you're Doing It WrongTM :doing_it_wrong:

  • (disco)

    What if someone is blind and doesn't load images?

    What if someone is using Lynx?

    What if it's a Palm Pilot?

  • (disco) in reply to Ashley_Sheridan

    I might be missing the obvious here, but what 'older long version' of object notation are you talking about?

  • (disco) in reply to blakeyrat

    Doing the IMG-thingy worked for some years before DOM manipulation became an option.

  • (disco) in reply to caerphoto

    I mean the typical, creating an object and adding properties to it one by one using dot notation. That was how the early javascript books used to teach as older browsers didn't support the {} syntax for a while (at least as far as I remember)

    That's why back in the day, people used to just use arrays for most of their js needs instead of going the oop way

  • (disco)

    If all you have is a hammer, you try to squeeze as much info in your nail as possible, that's obvious. Nothing to see here, move along.

  • (disco)

    The Wii browser (an extremely dumbed down version of Opera) had some special javascript function that could access the controller buttons. It also had Flash player. Apparently in order to access the controller from your Flash game, you had to make some code change the width of a < div> and then read it from the Flash code.

  • (disco) in reply to DCRoss

    What if your webserver is an Arduino?

  • (disco) in reply to blakeyrat

    You're going to send megabytes of json/data over to the client side with the original request so the client side can parse though it all to do some kind of query on it to potentially get a yes/no answer? You're going to send json that contains personal information on other users, and so on to get these answers? Client side is client side. Transferring it securely isn't the point, if it's just sitting there once it's there. The user isn't necessarily privy to the information used to get whatever the answer you want to give them is.

    Honestly, I don't even think it's the exception that this would be an infeasible way to do it, so much as the rule.

  • (disco) in reply to Ashley_Sheridan

    Yeah, it took many years for JavaScript to slowly become a language that doesn't suck.

    ...

    Haha, just kidding! JavaScript still sucks.

  • (disco) in reply to vita10gy

    What the heck are you talking about?

    The technique I mentioned is no different from AJAX. If you need server-side queries, well, then implement them. If you need pagination, well, then you can easily do that. If you're sending the user data they shouldn't have access to, well, then I guess you're a pretty shitty software developer.

    I have absolutely no idea what you are complaining about, or what "changes" when you have large amounts of data using the old-fashioned SCRIPT tag method that doesn't also apply to the modern AJAX methods.

  • (disco) in reply to blakeyrat

    I thought you were basically saying you could get around ajax pre-ajax by more or less crapping out all the data into the original page at build time in a script tag. So, say, if you were doing a facebook like messaging service where you could search for users to IM with autocomplete: When you build that page you'd insert data for basically every user in the system into the page, and then use JS to sort it out as the user types a name. No additional requests, anything you could possibly need to know was already client side, much of it extraneous.

    I think I see now how you're saying you can do it though. Basically exactly what they did, except with a script tag with a reference to a file containing useful information, instead of a image/width/enum-ish hack. If that indeed did work, that would be much better.

    I concede. :yum:

  • (disco) in reply to vita10gy
    vita10gy:
    anything you could possibly need to know was already client side, much of it extraneous.

    You mean, just like CS did with the tag cloud, or Discourse does with the post ID of every post in the topic.

  • (disco) in reply to Dragnslcr

    Tell me about it. It still has really sucky UTF8 support, especially with regular expressions. And this is a language that's now being used on servers?!

  • (disco) in reply to urkerab
    urkerab:
    I thought escape() uses ISO-8859-1 if possible otherwise UTF-16, so for instance escape("£") is "%A3" while escape("😁") is "%uD83D%uDE01".

    That's basically right, but as far as I can tell webservers - at least our webservers - can't handle the %uXXXX style encoding. Also the code used to just assume everything was UTF-8, so when real UTF-8 was mixed with unsanitised input data all kinds of mojibake would result. If everything is proper UTF-8 it makes supporting LOTE almost trivial.

  • (disco)

    Wow, not a WTF so much as a stupendous hack. Forget IE6. That hack would've worked in IE4. Kudos to you, developers of yore.

    I always have a saying that maintaining legacy code is like archaeology. Most of the time it's boring and you're just wiping dust off old broken clay pots. But every so often you find yourself a Stargate. This is one of those times.

  • (disco) in reply to ammoQ

    I thought I had a clever idea with this previously: you'd load an iframe and examine its contents to get the response. (I believe this is allowed with same-origin pages.) But that's generally worse than writing a script tag and having it manipulate a global variable. If manipulating globals isn't an option (for instance, you're creating an array of requests), you could pass to the server an expression to insert the result into, eg window.fakeAjaxResults[74].

    (Yes, you could attach extra attributes to Document.currentScript, but no browser supports that without also supporting AJAX.)

Leave a comment on “MacGyver's XMLHTTPRequest”

Log In or post as a guest

Replying to comment #:

« Return to Article