I'm not a full-time Javascript developer. We have a web app and one piece is to write out a small informational widget onto another domain. This literally is just a html table with some values written out into it. I have had to do this a couple of times over the past 8 years and I always end up doing it via a script that just document.write's out the table. For example: <pre class="prettyprint"><code>document.write('<table border="1"><tr><td>here is some content</td></tr></table>'); </code></pre> on theirdomain.com <pre class="prettyprint"><code><body> .... <script src='http://ourdomain.com/arc/v1/api/inventory/1' type='text/javascript'></script> ..... </body> </code></pre> I always think this is a bit ugly but it works fine and we always have control over the content (or a trusted representative has control such as like your current inventory or something). So another project like this came up and I coded it up in like 5 minutes using document.write. Somebody else thinks this is just too ugly but I don't see what the problem is. Re the widget aspect, I have also done iframe and jsonp implementations but iframe tends not to play well with other site's css and jsonp tends to just be too much. Is there a some security element I'm missing? Or is what I'm doing ok? What would be the strongest argument against using this technique? Is there a best practice I don't get?

To be honest, I don't really see a problem. Yes, <code>document.write</code> is very old-school, but it is simple and universally supported; you can depend on it working the same in every browser. For your application (writing out a HTML table with some data), I don't think a more complex solution is necessary if you're willing to assume a few small risks. Dealing with DOM mutation that works correctly across browsers is not an easy thing to get right if you're not using jQuery (et al). The risks of <code>document.write</code>: <ul> <li> Your script must be loaded synchronously. This means a normal inline script tag (like you're already using). However, if someone gets clever and adds the <code>async</code> or <code>defer</code> attributes to your script tag (or does something fancy like appending a dynamically created <code>script</code> element to the <code>head</code>), your script will be loaded asynchronously. This means that when your script eventually loads and calls <code>write</code>, the main document may have already finished loading and the document is "closed". Calling <code>write</code> on a closed document implicitly calls <code>open</code>, which completely clears the DOM – it's esentially the same as wiping the page clean and starting from scratch. You don't want that. </li> <li> Because your script is loaded synchronously, you put third-party pages at the mercy of your server. If your server goes down or gets overloaded and responds slowly, every page that contain your script tag cannot finish loading until your server does respond or the browser times out the request. The people who put your widget on their website will not be happy. </li> </ul> If you're confident in your uptime, then there's really no reason to change what you're doing. The alternative is to load your script asynchronously and insert your table into the correct spot in the DOM. This means third parties would have to both insert a script snippet (either <code><script async src="..."></code> or use the dynamic script tag insertion trick. They would also need to carve out a special <code><div id="tablegoeshere"></code> for you to put your table into.

using document.write in remotely loaded javascript to write out content

I'm not a full-time Javascript developer. We have a web app and one piece is to write out a small informational widget onto another domain. This literally is just a html table with some values written out into it. I have had to do this a couple of times over the past 8 years and I always end up doing it via a script that just document.write's out the table.

For example:

document.write('<table border="1"><tr><td>here is some content</td></tr></table>');

on theirdomain.com

<body>
....
<script src='http://ourdomain.com/arc/v1/api/inventory/1' type='text/javascript'></script>
.....
</body>

I always think this is a bit ugly but it works fine and we always have control over the content (or a trusted representative has control such as like your current inventory or something). So another project like this came up and I coded it up in like 5 minutes using document.write. Somebody else thinks this is just too ugly but I don't see what the problem is. Re the widget aspect, I have also done iframe and jsonp implementations but iframe tends not to play well with other site's css and jsonp tends to just be too much. Is there a some security element I'm missing? Or is what I'm doing ok? What would be the strongest argument against using this technique? Is there a best practice I don't get?

Why we should not use document write in JavaScript?

. write is considered a browser violation as it halts the parser from rendering the page. The parser receives the message that the document is being modified; hence, it gets blocked until JS has completed its process.

Why is document write () not recommended anymore?

Another reason not to use document. write() is it doesn't support XHTML, but its not an issue since most web development uses HTML. Since document. write() fires after a page has finish loading, it causes performance issues and sometimes, may not even fire at all.

Is it good to use document write?

Warning: Use of the document. write() method is strongly discouraged.

Can we use document write in JavaScript?

The write() method in HTML is used to write some content or JavaScript code in a Document. This method is mostly used for testing purpose. It is used to delete all the content from the HTML document and inserts the new content. It is also used to give the additional text to an output which is open by the document.

To be honest, I don't really see a problem. Yes, document.write is very old-school, but it is simple and universally supported; you can depend on it working the same in every browser.

For your application (writing out a HTML table with some data), I don't think a more complex solution is necessary if you're willing to assume a few small risks. Dealing with DOM mutation that works correctly across browsers is not an easy thing to get right if you're not using jQuery (et al).

The risks of document.write:

Your script must be loaded synchronously. This means a normal inline script tag (like you're already using). However, if someone gets clever and adds the async or defer attributes to your script tag (or does something fancy like appending a dynamically created script element to the head), your script will be loaded asynchronously.

This means that when your script eventually loads and calls write, the main document may have already finished loading and the document is "closed". Calling write on a closed document implicitly calls open, which completely clears the DOM – it's esentially the same as wiping the page clean and starting from scratch. You don't want that.
Because your script is loaded synchronously, you put third-party pages at the mercy of your server. If your server goes down or gets overloaded and responds slowly, every page that contain your script tag cannot finish loading until your server does respond or the browser times out the request.

The people who put your widget on their website will not be happy.

If you're confident in your uptime, then there's really no reason to change what you're doing.

The alternative is to load your script asynchronously and insert your table into the correct spot in the DOM. This means third parties would have to both insert a script snippet (either <script async src="..."> or use the dynamic script tag insertion trick. They would also need to carve out a special <div id="tablegoeshere"> for you to put your table into.

using document.write in remotely loaded javascript to write out content - why a bad idea?

Tags:

javascript

security

timpone

People also ask

1 Answers

josh3736

Recent Activity

Donate For Us