Ajax: HTML creation against HTML injection

Trying to execute a StackOverflow suggestion to ask a question without creating a discussion, let's look at these two methods that use HTTPAsyncRquest to refresh a webpage without updating:

1) The data returned by AsyncRequest is parsed / interpreted to create the resulting HTML, which refreshes the page for example JSON :: parseAndExecute (returnedData); // Just an example

2) The data returned by AsyncRequest is a raw jScript that runs and refreshes the page. for example plain old: eval (returnData); // we KNOW returnData is not malicious code

To eliminate academic / preference problems, suppose we use the same structure for programming both the server and the client, with the only difference being that there is an option / flag to make it spit out JSON or raw jscript.

In this case, are there any technical reasons why you should choose?

I ask about this, because raw ARIPT in most cases should be faster and more flexible, but most found structures do not return ARIPT, but instead data, which in turn are interpreted by AKIP.

(Just to clarify: I ask if this is less? Faster? Are there security risks? Compatibility risks?)

First post on stackoverflow, ye!

+5
source share
2

, , , . , , . Ajax Framework, . , , () eval. ANYWAY, IE8 "" JSON eval .

(Ra-Ajax), JSON HTML (innerHTML ) Ajax Engine. JSON , innerHTML ( ) .

+1

@ :

, . , . Javascript-, , , , JSON.

(JSON), - / .

+1

All Articles