//**************Load JSon
	function loadJSON(fname,a) 
	{
		var xhr=createXHR();
		xhr.open("GET", fname,true);
		xhr.onreadystatechange=function() 
		{
			if (xhr.readyState == 4) 
			{
				if (xhr.status != 404) 
				{
					//If AllBags
					if(a == "#allBags") {
						var data=eval("(" + xhr.responseText + ")");
						var temp = '';
						mod = data.length%5; if(mod==0) { mod=5; }
						for (var i=0 ; i < data.length ; i++)
						{
							if((i+1)%5==0 && i!=0 && i!=data.length-1) { temp += "<div class='rightBag'><a class='pop' data='product-" + data.id + "' href='#product'><img src='img/essai-sac1.jpg' width='130' height='130' alt='" + data[i].long_description + "'/></a></div>"; }
							else if((i+1)>(data.length-mod) && i!=data.length-1) { temp += "<div class='bottomBag'><a class='pop' data='product-" + data[i].id + "' href='#product'><img src='img/essai-sac1.jpg' width='130' height='130' alt='" + data[i].long_description + "'/></a></div>"; }
							else if(i==data.length-1) { temp += "<div class='bottomBag rightBag'><a class='pop' data='product-" + data[i].id + "' href='#product'><img src='img/essai-sac1.jpg' width='130' height='130' alt='" + data[i].long_description + "'/></a></div>"; }
							else { temp += "<div><a class='pop' data='product-" + data[i].id + "' href='#product'><img src='img/essai-sac1.jpg' width='130' height='130' alt='" + data[i].long_description + "'/></a></div>"; }
							temp += "<div class='popin' id='product'><span class='close'>Close</span><div class='content'></div></div>";
						}
						$j("#allBags .content").html(temp);
					}
				} 
				else 
				{
					if(a == "#allBags") {
						$j("#allBags .content").html(fname + " not found");
					}
				}
			}
		}
		xhr.send(null);
	}

rs459 a écrit :
Salut,

Attention à eval !!

https://www.owasp.org/index.php/OWASP_AJAX_Security_Guidelines

XSS via eval dans ton script.