Question

If i have a website1.com and website2.com, can I send data ( ex: value from input ) from website2.com to website1.com and receive result? with no page refresh or redirect. I’d like to use only javascript & ajax, no PHP or jQuery. If it is possible give me an example how to do it.

I thought about creating an script element ( with javascript) on website2.com with src like : website1.com?data=<value from input>, and when script element loads the src, it will show me an result, but maybe there is a better option to do this.

PS: I will have more separated datas to send.

Note: this is not XSS, just a public project for websites, which will need to update datas every x minutes and to send some data to website1.

Thanks.

Answer 1

Since XmlHttpRequest does not work cross-domain, you have to use JSONP. Basically, this is adding a script tag dynamically as you’re suggesting to do. Then, the server uses your GET datas, does whatever it wants, and usually “prints” a callback function.

When you call a file using the script tag, it will evaluate everything displayed. This is why, if, on the server side, you’re doing :

<?php
echo 'alert(1);';
?>

This will be evaluated as javascript. You can then easily understand how to use a callback function (another GET parameter).

Also, in jQuery, there is an option called ‘jsonp’ when you call $.ajax (using “callback” as default GET parameter, but can be changed).