Helper API Security This topic describes security issues
associated with XMLHTTP and ServerXMLHTTP. In addition, it
provides some guidance for mitigating security exposure. The
following sections provide information about Helper API
security, with an emphasis on XMLHTTP. Use XMLHTTP Only on the
Client XMLHTTP should only be used on the client. Because
XMLHTTP is marked safe for scripting, you call XMLHTTP from a
script that is executed in the client-side Internet browser.
Remember, you can use XMLHTTP and ServerXMLHTTP in any arbitrary
script, inside or outside the browser. XMLHTTP is not safe for
server-side implementation. Using XMLHTTP on the server means
that you would use XMLHTTP via JScript, VBScript, C++, ASP, or
ASP.NET. XMLHTTP is not thread-safe - it doesn't work for multi-
threaded scenarios. If you use XMLHTTP, you will not receive an
error, but your script may not perform properly. If you need
XMLHTTP functionality on the server, you should use
ServerXMLHTTP, not XMLHTTP. XMLHTTP Uses Cached Crede