Because you cannot issue cross-domain AJAX calls, the attacker does not have access to the response body as a string that can be manipulated. https://secure.wi

Because you cannot issue cross-domain AJAX calls, the attacker does not have access to the response body as a string that can be manipulated. https://secure.wikimedia.org/wikipedia/en/wiki/Same_origin_policy https://secure.wikimedia.org/wikipedia/en/wiki/Same_origin_p...