[Techtalk] why is Active X in web pages evil, but not Perl/PHP/Javascript?

[Mary]

On Thu, Jan 20, 2005, Mary wrote:
> On Wed, Jan 19, 2005, Carla Schroder wrote:
> > This is all very helpful, thank you! So it is correct to say that
> > using server-side scripting avoids browser compatibility problems?
>
> You can produce really browser specific HTML with server-side scripting,
> just as you can by hand. (Some people even produce Javascript with
> server-side scripting -- after all, just as HTML is text to be sent to a
> browser, so is Javascript.)

Actually, another way of looking at this is to say that it's not that
*using* server-side scripting avoids browser compatibility problems,
it's that *not using* client-side scripting avoids browser compatibility
problems.

A website designer doesn't usually have a choice between using
server-side scripting and client-side scripting to solve the same
problem anyway. You solve different problems with them:

 - server-side scripting: you use this when the content (imagine
   "shopping carts" or choosing advertising based on a person's previous
   visits) of your pages can't be worked out in advance or changes
   between different users of your webpage.

 - client-side scripting: you use this when you want to make a browser
   sing and dance (essentially). The normal way to use it (leaving aside
   malicious ways) is to get browsers to do things that HTML wasn't
   designed for. HTML is a text markup language that doesn't have
   encodings for "this thing is red except if the mouse is over it": if
   you want to have a page with special effects when a user moves their
   mouse to a part of the page, then this is what client-side scripting
   is designed for[1].

So you can think of server-side scripting as a way of generating custom
content for viewers and client-side scripting as a way of producing
special effects in the appearance of your pages. There *is* some
blurring between these definitions, especially when it comes to full
blown client side Java (not Javascript, think of them as two fairly
different languages with similar names), but I won't go into it --
largely because I've done very little client-side scripting!

-Mary

[1] CSS can do some limited special effects of this sort too. Client
side scripting languages like Javascript pre-date CSS though.