RFD: How To Recognize Bad Javascript Code

[Jeremy J Starcher]

(Request for Discussion)

I've put together a guide that I hope will help novice coders avoid the
same hair pulling that I went through.

I'm open for comments about it.

Have I missed the mark on a point or two?
Have I overlooked something?
Is my basic goal flawed? Is code bad in so many different ways that I
should just pack up shop and forget this?

Or did I do a smashing bang-up job that will keep the new coders away from
the horrors of most online examples and finally end c.l.j's favorite
hobby?(*)

(*) Saying "That's junk! Don't do that!"

[Jeremy J Starcher]

On Tue, 01 Jan 2008 05:28:51 -0500, Jeremy J Starcher wrote:

(Request for Discussion)

I've put together a guide that I hope will help novice coders avoid the
same hair pulling that I went through.

And it would really help if I included

<URL: http://www.mopedepot.com/jjs/HowToRe...criptCode.html >

[slebetman]

On Jan 1, 6:37 pm, Jeremy J Starcher <[e-mail] am.me.not.com>
wrote:

On Tue, 01 Jan 2008 05:28:51 -0500, Jeremy J Starcher wrote:

(Request for Discussion)

I've put together a guide that I hope will help novice coders avoid the
same hair pulling that I went through.

For the language="javas cript" issue you recommended:
<script type="text/javascript"></script>

Personally I'd recommend just using:
<script></script>

Partly because "text/javascript" is an invalid MIME type, it should be
"applicatio n/javascript". But "applicatio n/javascript" is invalid
HTML, it MUST be "text/javascript". So best to avoid it altogether and
save keystrokes/bytes.

[Thomas 'PointedEars' Lahn]

slebetman wrote:

On Jan 1, 6:37 pm, Jeremy J Starcher <[e-mail] am.me.not.com>
wrote:

>On Tue, 01 Jan 2008 05:28:51 -0500, Jeremy J Starcher wrote:

>>(Request for Discussion)
I've put together a guide that I hope will help novice coders avoid the
same hair pulling that I went through.

For the language="javas cript" issue you recommended:
<script type="text/javascript"></script>

Which is correct.

Personally I'd recommend just using:
<script></script>

So you would recommend invalid markup.

http://validator.w3.org/

Partly because "text/javascript" is an invalid MIME type,

It isn't.

it should be "applicatio n/javascript".

It shouldn't.

But "applicatio n/javascript" is invalid HTML,

It isn't.

it MUST be "text/javascript".

It needs not to.

So best to avoid it altogether and save keystrokes/bytes.

You are completely wrong:

http://pointedears.de/scripts/test/mime-types/

BTW, we discussed this only a few days ago. Please read before you post.
PointedEars
--
realism: HTML 4.01 Strict
evangelism: XHTML 1.0 Strict
madness: XHTML 1.1 as application/xhtml+xml
-- Bjoern Hoehrmann

[Richard Cornford]

slebetman wrote:
<snip>

For the language="javas cript" issue you recommended:
<script type="text/javascript"></script>

Personally I'd recommend just using:
<script></script>

Which could never be valid (x)HTML mark-up as the TYPE attribute is
required by the pertinent validity rules.

Partly because "text/javascript" is an invalid MIME type,

It is not an "invalid" MIME type. It was a fictional MIME type up until
2006, and then it became an inappropriately labelled "obsolete" MIME
type (inappropriate because it does not make sense to declare something
as obsolete until it is practical to not use it).

it should be "applicatio n/javascript".

And it probably will be "applicatio n/javascript" at some point in the
relatively distant future when "text/javascript" actually becomes
obsolete.

But "applicatio n/javascript" is invalid HTML,

No it is not. The values for the TYPE attribute are externally
referenced from the (x)HTML specifications in a way that implies that
any current MIME type would be valid (and mark-up validators don't check
those external references anyway).

it MUST be "text/javascript".

There certainly is no "MUST" about it. The formulation
TYPE="text/javascript" is used because it is the valid mark-up that has
been observed to be universally successful (or non-problematic). The
odds are that that universal effectiveness results from
"text/javascript" being used as an example value in the HTML
specification, regardless of the fact that at the time there was no MIME
type for javascript.

So best to avoid it altogether and
save keystrokes/bytes.

So it comes down to an appeal to idleness? There may be valid reasons
for abandoning mark-up validity but idleness does not seem like
sufficient reason in itself. (Especially is it is actually being too
idle to write (or go out and find) a macro that will insert the entire
script tag as a result of one action, or use some other similar editor
facility.)

Richard.

[Jeremy J Starcher]

On Tue, 01 Jan 2008 05:14:23 -0800, slebetman wrote:

Personally I'd recommend just using:
<script></script>

Partly because "text/javascript" is an invalid MIME type, it should be
"applicatio n/javascript". But "applicatio n/javascript" is invalid
HTML, it MUST be "text/javascript". So best to avoid it altogether and
save keystrokes/bytes.

I had forgotten about "applicatio n/javascript" I saw that discussion a
few days ago and made a mental note. Since my mental notes are written in
the sea-shore at low tide -- I forgot.

It is my understanding that this mime type is actually recognized by
anything in the world and has been rushed into service without a valid
reason for the rush.

We hang onto "text/javascript" because pretty much everything supports it
and it still works. Not only works, but works better than its proposed
replacement.

[Doug Miller]

In article <pa************ *************** *@yahoo.spam.me .not.com>, Jeremy J Starcher <r3***@yahoo.sp am.me.not.comwr ote:

>On Tue, 01 Jan 2008 18:01:51 +0100, Thomas 'PointedEars' Lahn wrote:

>Jeremy J Starcher wrote:

>>Have I missed the mark on a point or two?
Have I overlooked something?

Plenty.

1. "Depreciate d script tag usage"

a. The word you were looking for is _deprecated_, not "depreciate d".

Absolutely correct. Thought I spell-checked everything. I'll fix that.

"Depreciate d" *is* correctly spelled. It's just not the right word. :-)

--
Regards,
Doug Miller (alphageek at milmac dot com)

It's time to throw all their damned tea in the harbor again.

[Randy Webb]

Jeremy J Starcher said the following on 1/1/2008 12:59 PM:

On Tue, 01 Jan 2008 18:01:51 +0100, Thomas 'PointedEars' Lahn wrote:

<snip>

> d. "JavaScript 1.2" actually means something in NN4; ask Google.
I have never seen anyone using "JavaScript1.3" , though.

I didn't know if that was backwards compatible to browsers today or not.
If memory serves me correctly, it changes some of the array methods.

The most notable thing it did was change comparisons.

var x=2
var y="thirty"
if(x=y){
alert('They are equal')
}

>2. 'Using "href:javascrip t"'

| Using the pseudo-protocol javascript in the href is never valid. Not
| only is such code not valid HTML, [...]

Wrong. The value of the `href' attribute is of type URI. If
`javascript:' syntax would be written as an URI, it would certainly
be valid there. One point of recommending against `javascript:'
there is that

| it cannot provide a fallback to browsers not running Javascript.

There are other points that I have also mentioned in my FAQ notes last
year. There are also exceptions to be made in special cases.

Hmmm... This point has me thinking now. I'll have to ponder the best way
to phrase the URI issue. "Valid, but not recommended" perhaps.

I'll try and find your FAQ notes. If you are feeling generous I'll take a
donated URL to it.

The group FAQ, and the Notes pages on it, cover just about every aspect
of javascript: protocols.

>4. 'Not ending lines in a semi-colon ";"'

The argument in favor of the trailing `;' is flawed in two regards:
a) not every line should be ended with a semicolon but every *statement*;

I code in C. I know that. Somewhere it got lost between brain and
keyboard. Maybe I've been using "one statement per line" scripting
languages too much.

The argument of "This is the way it works in <otherlanguage" , isn't an
argument when it comes to Javascript.

> b) minifiers should not be used. See previous discussions.

I knew that was going to come up. I'm tempted to yank that whole section
out, except that style-wise I -really- like having the semicolon there.
Code without it grates on me.

It should be pulled.

>5. "Use of eval"

| Using eval to parse JSON works well. While there are some security
| concerns, they can be easily addressed.

There are two other uses where using eval() is considered appropriate.
One is making arbitrary computations with user input,

Yes, I should mention that. While I've only seen it used for "trivial"
calculator applications, I suppose it would be the basis for an Javascript
spreadsheet or something.

See my other reply. eval will beat "traditiona l" methods of computation
hands down. And the example I posted is a very simple example.

using try/catch. The try/catch is faster when available.

try/catch is another of the things you didn't cover. Don't use it.

> A reasoning for the statement that the security concerns could be
easily addressed is missing.

I'll toss in this link: <URL: http://www.json.org/json2.js In my
reading, I haven't heard of anyone finding holes in it.

There is a non-eval alternative to JSON.

--
Randy
Chance Favors The Prepared Mind
comp.lang.javas cript FAQ - http://jibbering.com/faq/index.html
Javascript Best Practices - http://www.JavascriptToolbox.com/bestpractices/

[Jeremy J Starcher]

On Tue, 01 Jan 2008 13:13:51 -0500, Anthony Levensalor wrote:

<snip>

Are you a programmer or an English teacher? Oh, you're both! That would
explain a whole bunch.

<snip>

This, right here, this is why people get irritated with you, I think.
Maybe you just like being a pompous arrogant , I dunno, but most other
people don't care for it. You lack that internal filter that says "don't
say that, that's what a pontificating, unmitigated ass would say"

[start way off-topic]

While I don't know Thomas "PointedEar s" personally, and won't speak for
him I do know his personality type. Rather than defend him in particular
allow me to say a few words for the entire "have-no-people skills but
really good with machine" type people.

Or not. You said it already. "You lack that internal filter..."

In many cases that is literally true. An unusually high percentage of
people with Asperger's Syndrome enter computer science. Among other
issues, people with Aspergers lack the social graces that the rest of the
population wears.

Once again, I don't know Thomas personally, but I will say this. This
group needs him and people like him. They are the ones who remind us of
the edge cases. They are the ones who will remember weird interactions of
code and will spot flaws long before they become an issue.

When someone says 'All prime numbers are odd' they are the ones who will
remind us of the exception. While their delivery may lack social grace,
it always carries content.

While these people may not always be right, you would do well to listen to
their advice. If, in the end, you cannot see through personality flaws to
the real issues of code and programming then problem is yours. Rude
people cannot offend you. You can choose to be offended.

This is my only post on this particular thread. If you wish to have a
real discussion, feel free to start a new thread called "Gee! Why are
you people so rude?"

[end way off-topic]

[AKS]

On Jan 1, 11:30 pm, Randy Webb <HikksNotAtH... @aol.comwrote:

Things you didn't cover:
...
Use of "new Function".

Is there anything wrong with use of "new Function"?