title: using document.write in remotely loaded javascript to write out content - why a bad idea?
body: <p>I'm not a full-time Javascript developer. We have a web app and one piece is to write out a small informational widget onto another domain. This literally is just a html table with some values written out into it. I have had to do this a couple of times over the past 8 years and I always end up doing it via a script that just document.write's out the table.</p>
  
  <p>For example:</p>
  
  <pre><code>document.write('&lt;table border="1"&gt;&lt;tr&gt;&lt;td&gt;here is some content&lt;/td&gt;&lt;/tr&gt;&lt;/table&gt;');
  </code></pre>
  
  <p>on theirdomain.com</p>
  
  <pre><code>&lt;body&gt;
  ....
  &lt;script src='http://ourdomain.com/arc/v1/api/inventory/1' type='text/javascript'&gt;&lt;/script&gt;
  .....
  &lt;/body&gt;
  </code></pre>
  
  <p>I always think this is a bit ugly but it works fine and we always have control over the content (or a trusted representative has control such as like your current inventory or something). So another project like this came up and I coded it up in like 5 minutes using document.write. Somebody else thinks this is just too ugly but I don't see what the problem is. Re the widget aspect, I have also done iframe and jsonp implementations but iframe tends not to play well with other site's css and jsonp tends to just be too much. Is there a some security element I'm missing? Or is what I'm doing ok? What would be the strongest argument against using this technique? Is there a best practice I don't get?</p>