<p>I have a small JS function that does Ajax for me and another like it that adds in POST data to the request. With Ajax being such a big topic with so many libraries about it, what am I missing from my function, is it insecure or something else worrying?</p>

<pre><code>function loadPage(pagePath, displayElement)
{
    var xmlHttp;

    try
    {
        // Firefox, Opera 8.0+, Safari
        xmlHttp=new XMLHttpRequest();
    }
    catch (e)
    {
        // Internet Explorer
        try
        {
            xmlHttp=new ActiveXObject("Msxml2.XMLHTTP");
        }
        catch (e)
        {
            try
            {
                xmlHttp=new ActiveXObject("Microsoft.XMLHTTP");
            }
            catch (e)
            {
                alert("Your browser does not support AJAX!");
                return false;
            }
        }
    }

    xmlHttp.onreadystatechange=function()
    {
        if(xmlHttp.readyState==4)
        {
            document.getElementById(displayElement).innerHTML = xmlHttp.responseText;
        }
    }

    xmlHttp.open("GET", pagePath, true);
    xmlHttp.send(null);
}
</code></pre>

[{'answer_id': 34538, 'author': 'MattGrommes', 'author_id': 3098, 'author_profile': 'https://Stackoverflow.com/users/3098', 'pm_score': 5, 'selected': True, 'text': "<p>I strongly recommend you not roll your own Ajax code. Instead, use a framework such as Prototype, Dojo, or any of the others. They've taken care of handling all the ReadyStates you're not handling (2 means it's been sent, 3 means it's in process, etc.), and they should escape the reponse you're getting so you don't insert potentially insecure javascript or something into your page.</p>\n\n<p>Another thing a more robust framework will give you is the ability to do more than just use innerHTML to replace items in the DOM. Your function here can only be used to replace one element with the response from the ajax call. There's a lot more you can do with Ajax.</p>\n"}, {'answer_id': 34539, 'author': 'Patrick McElhaney', 'author_id': 437, 'author_profile': 'https://Stackoverflow.com/users/437', 'pm_score': 3, 'selected': False, 'text': '<p>I would remove this line.</p>\n\n<pre><code>alert("Your browser does not support AJAX!")\n</code></pre>\n\n<p>Shouting at the user in a language he probably doesn\'t understand is worse than failure. :-)</p>\n'}, {'answer_id': 34625, 'author': 'ceejayoz', 'author_id': 1902010, 'author_profile': 'https://Stackoverflow.com/users/1902010', 'pm_score': 1, 'selected': False, 'text': '<p>jQuery is probably one of the lightest popular libraries out there.</p>\n'}, {'answer_id': 34714, 'author': 'Lee Theobald', 'author_id': 1900, 'author_profile': 'https://Stackoverflow.com/users/1900', 'pm_score': 2, 'selected': False, 'text': '<p>I\'ve never been a fan of nested try/catch blocks, so I\'d do it something like:</p>\n\n<pre><code>var xmlHttp;\nif (window.XMLHttpRequest) {\n  // Firefox, Opera 8.0+, Safari\n  xmlHttp=new XMLHttpRequest();\n} else if (window.ActiveXObject) {\n  try {\n    xmlHttp=new ActiveXObject("Msxml2.XMLHTTP");\n  } catch (e) {\n    xmlHttp=new ActiveXObject("Microsoft.XMLHTTP");\n  }\n}\n\nif (xmlHttp) {\n  // No errors, do whatever you need.\n}\n</code></pre>\n\n<p>I think that\'ll work.  But as has been mentioned before - why reinvent the wheel, use a library.  Even better - find out how they do it.</p>\n'}, {'answer_id': 39376, 'author': 'erlando', 'author_id': 4192, 'author_profile': 'https://Stackoverflow.com/users/4192', 'pm_score': 1, 'selected': False, 'text': '<p>The same thing in prototype:</p>\n\n<pre><code>function loadPage(pagePath, displayElement) {\n    new Ajax.Updater(displayElement, pagePath);\n}\n</code></pre>\n\n<p><a href="http://prototypejs.org/api/ajax/updater" rel="nofollow noreferrer">Ajax.Updater in Prototype API</a></p>\n'}, {'answer_id': 6761093, 'author': 'Sean McMillan', 'author_id': 117587, 'author_profile': 'https://Stackoverflow.com/users/117587', 'pm_score': 0, 'selected': False, 'text': '<p>If you really want to see what you are missing, read the jQuery or Prototype source code for their ajax routines. If there are bug numbers in the comments, look those up as well.</p>\n'}]
['https://Stackoverflow.com/questions/34486', 'https://Stackoverflow.com', 'https://Stackoverflow.com/users/1384652/']