XMLHttpRequest help (alternative)

purg · Apr 4, 2008

Ive written the HTML below to allow the clients browser to lookup whois (the aim was to send reply back to the host). This works while testing offline but due to security you cant load a page from a remote site using XMLHttpRequest. Do you know how this could be done?

Im wanting the client browser to lookup whois then return the data back to a server. This will help keep whois data upto date also help get around the 1000 lookup a day limit.

Code:

<head>
<script language="JavaScript">

var xmlhttp=false;
/*@cc_on @*/
/*@if (@_jscript_version >= 5)
// JScript gives us Conditional compilation, we can cope with old IE versions.
// and security blocked creation of the objects.
 try {
  xmlhttp = new ActiveXObject("Msxml2.XMLHTTP");
 } catch (e) {
  try {
   xmlhttp = new ActiveXObject("Microsoft.XMLHTTP");
  } catch (E) {
   xmlhttp = false;
  }
 }
@end @*/
if (!xmlhttp && typeof XMLHttpRequest!='undefined') {
	try {
		xmlhttp = new XMLHttpRequest();
	} catch (e) {
		xmlhttp=false;
	}
}
if (!xmlhttp && window.createRequest) {
	try {
		xmlhttp = window.createRequest();
	} catch (e) {
		xmlhttp=false;
	}
}

function FetchPage(domain,ref) {
 xmlhttp.open("GET", "http://webwhois.nic.uk/cgi-bin/whois.cgi?query="+domain,true);
 xmlhttp.onreadystatechange=function() {
  if (xmlhttp.readyState==4) {
   if (xmlhttp.responseText.indexOf('This domain name has not been registered') !=-1)
   {
      document.getElementById('domain'+ref).innerHTML='Domain '+domain+' <b>available</b>'
      document.getElementById('domain'+ref).style.display='block'
   }
   else
   {
      var wdate = xmlhttp.responseText.substr(xmlhttp.responseText.indexOf('lookup made at ')+13);
      var wdate = wdate.substr(2,wdate.indexOf('--')-8);
      document.getElementById('hide'+ref).style.display='block'
      document.getElementById('domain'+ref).innerHTML=' '+domain+' <b>Not available</b>'+wdate
      document.getElementById('domain'+ref).style.display='block'
      document.getElementById('expand'+ref).style.display='none'
      document.getElementById('whois'+ref).innerHTML=xmlhttp.responseText
      document.getElementById('whois'+ref).style.display='block'
   }
  }
 }
 xmlhttp.send(null)
}


function rez(ref) {
   document.getElementById('domain'+ref).style.display='none'
   document.getElementById('expand'+ref).style.display='block'
   document.getElementById('hide'+ref).style.display='none'
   document.getElementById('whois'+ref).style.display='none'
}


</script>

<title>test</title>
</head>
<body>

<div id='hide99' style="display:none">[<a href="#" onClick="rez(99);return false;">-</a>]</div>
<div id='domain99' style="display:none"></div>
<div id='expand99' style="display:block">[<a href="#" onClick="FetchPage('somesite.co.uk',99);return false;">+</a>] somesite.co.uk</div>
<div id='whois99' style="display:none"></div>

<div id='hide98' style="display:none">[<a href="#" onClick="rez(98);return false;">-</a>]</div>
<div id='domain98' style="display:none"></div>
<div id='expand98' style="display:block">[<a href="#" onClick="FetchPage('whatdomain.co.uk',98);return false;">+</a>] whatdomain.co.uk</div>
<div id='whois98' style="display:none"></div>



</body>
</html>

julian · Apr 7, 2008

Interesting..I just had a thought how good would a AJAX dn look up be - is that what your tryi do do!?

would that even be possible - serious overhead on db maybe?

due to security you cant load a page from a remote site using XMLHttpRequest.

are you sure this can't be done.

I'm probaly being thick but your trying to use the XMLHttpRequest object to read the NIC page so you can see if domain available or not?

If so, can you just use the innerhtml method to read the pre tag to get the nic info? bit of a hack I know but if availability all you want?

cheers

tifosi · Apr 7, 2008

julian said:
due to security you cant load a page from a remote site using XMLHttpRequest.

are you sure this can't be done.

Usine the XMLHttprequest as designed, no you can't. This security measure is built in. Only the requesting domain can get information.

There are 'workarounds' but they risk injection attacks.

Bulletproof ajax is a good book on the subject

S

purg · Apr 8, 2008

guys you both a star! its not your posts but allowed me to come out with a workaround.

Because XMLHttpRequest requested domain must came from the same domain it now obvious how to get around this

script1 - XMLHttpRequest to script2.php?redirect=http://www.someotherdomain.com
script2 - $_GET and cURL to where I really wanted to get to.

The real world example is the dailydomain site ive posted in tools which uses socket commands in place of cURL.
http://www.acorndomains.co.uk/domain-tools/34040-free-daily-co-uk-drop-list-site.html

Thank you