AJAX has dominated the web space so extensively that it needs no introduction. Connecting to a server via XMLHttpRequest and making a partial page refresh is what makes this technique so attractive. However, use of these AJAX requests, although very attractive, can pose dangers as well. JavaScript acts as a vector to infect websites with worms, such as SAMY, using cross-site scripting, also known as CSS or XSS.

In a previous article - "Enabling Server data with native web service" - I explain how a web service of type HTML is created on the SQL Anywhere server, which can serve HTML pages, and that to make an AJAX call for this page from your browser, you need to make a call to the hosting domain, the SQL Anywhere Web Server.

Details of the AJAX Accessed Resource
In the cited previous article, the resource is accessed on the localhost at port 8082, or any port chosen for this purpose. To send an AJAX call you have to call this domain at the same port as required by the same origin policy, the browser security model that prohibits using the XMLHttpRequest across domains. There is even a proposal at W3C to make cross-domain access possible as there may be cases when this type of access is needed. Of course, there are workarounds even now using scripts, Flash, etc.

In the cited article the web service of type HTML called TestHtmlSvc retrieves a selected portion of the Customer's data from a table in the sample demo database. Note that the page can be called up by accessing this page at its URL, http://localhost:8080/demo/TestHtmlSvc.

In this article an AJAX call will be made to access the same resource. To make such a call, an AJAX HTML page will be created and hosted on the same server so that the boundary of the browser security model isn't trespassed.

Creating a Stored Procedure
These SQL Anywhere articles describe in great detail not only the SQL Anywhere Server and its tools but also how stored procedures are created in the SQL Anywhere Server using the Wizard as well as SQL scripts. For the procedure described in this article, the AJAX page will be created as a result of running a stored procedure.

First, a stored procedure called Sabon is created on the SQL Anywhere Server as shown in Listing 1.

Some of the HTML monitors the status of the call and information about the headers. Note that the getPage () function calls up http://localhost:8082/demo/TestHtmlSvc by making an XMLHttpRequest. The coding is quite straightforward but follows the same lines as in the article "Step by Step to AJAX." Simply stated, you create an XMLHttpRequest and access the resource by a GET method and then parse the response.

The SQL Anywhere databases' HTTP Server is the SAWebServer used in the previous article. Figure 1 shows the stored procedures on this database including the Sabon stored procedure.

Figure 1

A Web Service to Call This Procedure
After creating the stored procedure Sabon, a web service of type RAW (one of several types in SQL Anywhere) called Ajaxian is created. The details of how this is created are also explained in the cited article. Again, as in the case of stored procedures, a web service may be created using script or using the built-in wizard in Sybase Central (SQL Anywhere's graphical database administration tool). Figure 2 shows one of the screens of the wizard that is used to create the web service.

Figure 2

Figure 3 shows the web services on the SQL Anywhere server. Note that the web service Ajaxian is of type RAW, which needs no authentication with the DBA as user. Now this web service can be URL accessed as shown in Figure 4.

Figure 3

The AJAX Call
The Ajaxian web service is accessed using its URL as shown in Figure 4 - only a small portion of the returned data is captured.

Figure 4

In essence, the Ajaxian web service calls up the Sabon stored procedure, which serves up the page containing an AJAX call to the SQL Anywhere Server to retrieve the TestHtmlSvc page.

The XMLHTTPRequest's Headers, status, and state are shown in Figure 5, which is a screen capture of the displayed portion returned by the AJAX call.

Figure 5

Summary
The article shows how an AJAX call can be made to a resource on the SQL Anywhere Server using stored procedures and web services.