Chapter 5 of 10All chapters
Chapter 5 of 10
JavaScript in the browser
Reacting to what people do.
The DOM and events
Scripts read and change the live page through the DOM, and listen for events such as click, input and submit. Listening on a container and checking the target survives content being replaced.
- textContent is safe; innerHTML with untrusted input is how cross site scripting happens.
- Keep the page usable while data loads rather than blocking on it.
Progressive enhancement
Build something that works as HTML, then improve it. A page that shows nothing until a script runs fails for slow connections, old devices and every script error.