Category — howto
Using iframes for cross-site scripting
Here is an easy way to communicate different domains using frames:
Step 1: Create a file called iframe_remote.htm with the following:
<script type="text/javascript">
window.name="my test data";
</script>
</html>
The above code contains the data that you want to return to your calling script. I used a simple example with static data. Instead, a PHP (or any other programming language) script could be used to dynamically return data depending on the parameters (this data could also be JSON or XML).
Step 2: create a file called iframe.htm with the following:
<head>
<script language="javascript">
function loadFrame()
{
var crossData = "";
try
{
crossData = document.getElementById('cframe').contentWindow.name;
alert("data: "+crossData);
} catch(err) {}
}
function setFrame()
{
document.getElementById('cframe').src = 'iframe_dummy.htm';
}
</script>
</head>
<body>
<iframe id="cframe" name="test" src="http://yourdomain.com/iframe_remote.htm" onLoad="loadFrame()" style="display:none"></iframe>
<input type="button" value="Get Remote data" onclick="setFrame()">
</body>
</html>
Set the iframe src to the full path of iframe_remote.htm. This file should also be placed on the domain that is retrieving the remote data. You should also create a file on the same server as iframe.htm called iframe_dummy.htm.
This technique currently works in all major browsers.
How it works
Under normal circumstances, you can’t access remote data or properties in a frame across different domains due to security measures in place by your browser. The iframe name is the key to retrieving cross-domain data. The above code first loads an iframe with javascript that sets the iframe’s window.name property. After this, the iframe src is dynamically changed to a local file, the windows.name property is not changed, and your browser sees this as a file on the same domain.
April 21, 2009 4 Comments
How to stop IE from caching AJAX requests
While working on an AJAX project over the weekend, I ran into the following issue: (through a GET request), every time I tried to call a certain function, It was returning the same data (which was supposed to be different each time)
I first tried the following (which should disable browser caching):
(in PHP)
header( “Expires: Mon, 26 Jul 1997 05:00:00 GMT” );
header( “Last-Modified: ” . gmdate( “D, d M Y H:i:s” ) . ” GMT” );
header( “Cache-Control: no-cache, must-revalidate” );
header( “Pragma: no-cache” );
The data still did not change.
I finally came to the following solutions:
1) use a POST request. When using with xmlhttprequest, it is slightly more complicated.
2) add a unique identifier to the end of my GET url.
I choose #2. A unique Identifier can be created using the current data+time. Here is a simple way to generate this (in Javascript):
var date = new Date();
var timestamp = date.getTime();
createXMLHttpRequest();
xmlHttp.onreadystatechange = handleMessages;
xmlHttp.open(”GET”,”script.php?time=”+timestamp,true);
xmlHttp.send(null);
April 2, 2009 5 Comments
How to find slow mysql queries
It has happened to all of us running a website or application using mysql as its back-end database. Performance is suddenly very sluggish and you have no idea what is causing it. Now there may be other factors that are causing the issue (overloaded CPU, harddrive running out of space, or a lack of bandwidth), but it could also be a query that is not optimized and/or is taking much longer than it should to return.
How do you know which queries are taking the longest to execute? Mysql has built-in functionality for checking this through the slow query log.
To enable (do one of the following):
1) add this to /etc/my.cnf
log-slow-queries=/tmp/slow_queries.log
long_query_time=10
2) call mysqld with –log-slow-queries[=/tmp/slow_queries.log]
long_query_time is the maximum amount of seconds a query can take before it will be logged to the slow query log.
other related options:
–log-slow-admin-statements
Log slow administrative statements such as OPTIMIZE TABLE, ANALYZE TABLE, and ALTER TABLE to the slow query log.
–log-queries-not-using-indexes
If you are using this option with –log-slow-queries, queries that do not use indexes are logged to the slow query log.

If slow query logging has been enabled successfully, you will see “ON” in the VALUE field for “log_slow_queries” (shown above).
Note: Queries handled by the query cache are not added to the slow query log, nor are queries that would not benefit from the presence of an index because the table has zero rows or one row.
You may also run into the case where a query is slow at one time (such as when you are logging it) but not another (if you execute it manually):
- A table may be locked, causing the query to wait. the lock_time indicates how long the query waited for locks to be released
- none of the data or indexes have been cached in memory. This is common when MySQL first starts or your tables have not been optimizied
- a background process was running, making disk I/O considerably slower
- The server may have been overloaded with other unrelated queries at the same time, and there wasn’t enough CPU power to do the job efficiently
Log analysis
MySQL also comes with mysqldumpslow, a perl script that can summarize the slow query log and provide a better idea of how often each slow query executes.
March 25, 2009 No Comments