Is it safe to load HTML and js via ajax?

Question

I'm using the Jquery load function $('#result').load('test.php'); to load a page into another page by clicking a tab. The page I'm loading contains javascript, php, and contains a form. Using the firebug console I saw that there is a GET for all my script sources in the page I'm loading as well. Not sure if that should be a concern..

Can data be hacked via the jquery load? Are there any issues to consider?

note: I'm aware that old browsers don't work with javascript but is there anything else to consider?

Answer 1

So long as your site isn't compromised, a XHR to your own data is inherently no more dangerous than any other request.

Answer 2

Loading content using AJAX does not introduce any additional security issues.

An attacker can hijack the connection and inject his own Javascript (unless you're using HTTPS), but he can also do that to the page itself.

An attacker can exploit an XSS hole in your backend to run his own Javascript, but he can also do that to the page itself.

Answer 3

It really depends on how well you trust the source of the scripts. If you control them then there's no (additional) issue. If you're getting them from somewhere else (like jQuery from Google's CDN, for example) you're trusting that source.