Fixing JS injection about prototype

[jwestbrook]

That section of code is how the Ajax class sends the request to the server, not the response from the server.

I believe this is more about how the response is handled, so if the headers are Javascript, and the response is from the same origin then the response will be treated as Javascript and evaluated.

You can disable this behavior by setting the evalJS option to false.

For example

new Ajax.Request('/my/ajax/url',{'evalJS':false,'onSuccess':function(result){
    console.log(result.responseText);
});

[Johndiology]

Thanks very much!