Posted At : February 3, 2006 1:19 AM
| Posted By : Joe Danziger
Related Categories:
Prototype, AJAX
In the first post of this series, we looked at a really basic AJAX example. We simply pulled the time and date into our page via an AJAX call. In this post, we'll take things a step further by passing a variables in and using it in the output.
For this example, we'll take an input string and output it in reverse.
Here is a working sample:
This example is also pretty simple. We'll start again by including the Prototype script in the head of our document:
<script type="text/javascript"> function run_ajax() { var url = '/ajax/easy2.cfm'; var pars = 's='+escape($F('input_string')); var target = 'ajax_div'; var myAjax = new Ajax.Updater(target, url, {method:'get', parameters:pars}); } </script>
A few things to note in the above code block.. The line starting with "var pars" passes our data over to the AJAX page. We use $F() to get the value of the field with id "input_string" $F() is shorthand syntax that is built into Prototype and can save you lots of time and headaches. The old way was to write out document.getElementById() each time, so this is a lot shorter. We also escape the string in case there were any weird characters.
On the last line, in the Ajax.Updater call, we added braces to enclose any options including a reference to our parameters. In this case, we're specifying that this will be a get request, so we'll be expecting "URL." parameters in ColdFusion. A POST request would yield "FORM." parameters in our ColdFusion page.
Lastly, we need the ColdFusion page which will receive our call via AJAX and pass back the results. That page is actually really simple in this example, containing the following code:
Joe, Prototype does inded create a blissful abstraction.
From your description of the code above: escape($F('input_string'));
Am I correct in saying that the escape() function acts similarily to CF's URLEncodedFormat() to assist in escaping out special characters to help with security of query strings, specifically for cross-site scripting?
For Perl developers, the field notation should appear somewhat similar.
Yes, I believe that the escape function should work just like CF's URLEncodedFormat().
This is not done so much for security as it is to make sure that the URL being passed is OK (when doing a GET request). With AJAX, you typically can't go cross-domain. I say typically because you could create some kind of harness in the background to do the actual communications, but within the page you cannot go cross-domain.
I did not know about the cross domain calls. So, url that is executed in the run_ajax() cannot call a web service from another server outside the domain? I saw an example that Open Rico used to call a XML web service to find the weather report from weather.com.
I am not trying to point out a discrepancy, but rather trying to understand the logical flow of data. If the weather widget from rico doesn't go out of the domain, then there must be an equal widget to download the data first and then the ajax call would call a local xml data file. Would this be an accurate picture?
run_ajax() cannot call the web service directly - it must call a page within your domain. But once you call that page, you can then run any CFML you'd like in there - including calls to web services.
I wasn't trying to have you reclarify a point that I may I have missed. It makes sense to load the web service results in a template locally and then return the results to the AJAX call. The AJAX call would initiate the template that would lod the remote service.
Neil - Prototype doesn't really care what you use to get your data. Whether you're calling a CFC, or doing a CFQUERY directly in your page, all Prototype cares about is what is going to be output. It is not language specific in any way. It just takes a chunk of code and injects it back into the calling page.
What Teddy may be asking (or not, so I will) is how do you invoke a method in a cfc using prototype. I assume you would pass your function parameters using the param, but where does the actual function name go? In the url like myCFC.cfc?myFunction or is it something totally different?
Choosing A Slice And A CF Server
Joe Danziger said: @Jordan - thanks for providing the installer. That is a really great thing for the community and wi...
[More]
Blue Dragon To The Rescue
Joe Danziger said: @Todd: The thing is, I really blame the issues on the application and the fact that so many robots a...
[More]
Blue Dragon To The Rescue
Matt Woodward said: Nice Joe! Glad you found it so easy to get up and running. If you need any assistance just say the w...
[More]
Blue Dragon To The Rescue
Jordan Michaels said: Just a quick correction to the above post, OpenBD is licensed under the GPLv3, instead of 2. It's no...
[More]
Prototype does inded create a blissful abstraction.
From your description of the code above:
escape($F('input_string'));
Am I correct in saying that the escape() function acts similarily to CF's URLEncodedFormat() to assist in escaping out special characters to help with security of query strings, specifically for cross-site scripting?
For Perl developers, the field notation should appear somewhat similar.
T
This is not done so much for security as it is to make sure that the URL being passed is OK (when doing a GET request). With AJAX, you typically can't go cross-domain. I say typically because you could create some kind of harness in the background to do the actual communications, but within the page you cannot go cross-domain.
I am not trying to point out a discrepancy, but rather trying to understand the logical flow of data. If the weather widget from rico doesn't go out of the domain, then there must be an equal widget to download the data first and then the ajax call would call a local xml data file. Would this be an accurate picture?
T
run_ajax() cannot call the web service directly - it must call a page within your domain. But once you call that page, you can then run any CFML you'd like in there - including calls to web services.
Thank you. That does clarify a curious concern.
That would be superb :)