Secure HTML parsing / working with XMLHttpRequest

Question

I am writing code (right now this is a Chrome extension, although I can make it a cross browser or try to force site owners to enable the extension), which works with the contents of a specific <div> on the web page that the user is viewing, and any pages that are part of the same discussion topic. Therefore, I find links to other pages in the stream and retrieve them using XMLHttpRequest . What I want to do is just use .getElementsByClassName('foo') on the resulting page.

I know that I can do this by loading the query results into a div (i.e., what is the best way to retrieve the URL from a webpage loaded via XMLHTTPRequest? ). However, finding out the best way to do this, I read that there are security issues ( MDN - Secure Simple HTML Analysis for DOM ).

In this case, I'm not sure if this matters a lot, because the extension simply loads the page from the same comment topic that the user has already viewed, but I would still like to do it right.

So what is the right way to work with HTML with XMLHttpRequest ?

PS If jQuery is the best answer, then tell me that, but I haven't started using jQuery yet, and also would like to know the basic principles here.

Edit: I don’t know why I formulated what I did, but let me be more clear that I really hope for a non-jQuery answer. I tried to learn the basics of javascript before learning jQuery, and I would prefer not to import the whole framework to call a single function when I don’t understand what I am doing. It may seem irrational, but this is what I am doing at the moment.

Answer 1

Since you say you are not against using jQuery, you should look at the load function. It loads the html from the address you specify, and then puts it in the matched elements. For example,

 $("#formDiv").load("../AjaxContent/AdvSearchForm.aspx?ItemType=" + ItemType); 

Download the html from ../AjaxContent/AdvSearchForm.aspx , then put it in a div with the id formDiv

There are additional parameters for transferring data to the server with the request, as well as a callback function.