var current_el = null;
var loading;
var began = false      
function getItems(input, response){	

	if (response != ''){ 		
	    // Response mode	
	    //alert(response)    
        current_el.innerHTML = response;
        loading.style.display = 'none'
	}else{
		// Input mode	
		//input="cookie"
		var url  = "process_request.asp?p=" + input + "&hash=" + Math.random();
		
		//alert(url);
		var r=whiteListValidation(input);
		if (r==true)
		   {
			 loadXMLDoc(url); 
			}

	}
}

function loadItems(id,c){ 
	var img = null;
	if(arguments.length<2){
		c = "C" + id;
		img = document.getElementById("I"+id);
	}
	//alert(c)
	current_el = document.getElementById(c);
	if(current_el.style.display == 'none'){
		current_el.style.display = ''
		if(img)img.src = "images/minus.gif";
	}else{
		current_el.style.display = 'none'
		if(img)img.src = "images/plus.gif";
	}
	if(current_el.innerHTML == ''){
		loading.style.display = ''
		getItems(id,'');		
	}
}

function buildTree(id){
	if (!began){
		loading = document.getElementById("Loading")
		document.getElementById(id).style.display = 'none';
		began = true;
	}
	loadItems(0,id)
}

// JavaScript Document
function whiteListValidation(obj)// this function checks white list characters in a string
// return true indicates string does not contain any white list characters
	{
	 var scripts = new Array(); // holds white list words
			scripts[0]  = /PHP/;
			scripts[1]  = /ASP/;
			scripts[2]  = /JavaScript/;
			scripts[3]  = /HTML/;
			scripts[4]  = /<script>/;
			scripts[5]  = /<form>/;
			scripts[6]  = /php/;
			scripts[7]  = /asp/;
			scripts[8]  = /javascript/;
			scripts[9]  = /html/;
			scripts[10] = /cookie/;
			scripts[11] = /COOKIE/;
			scripts[12] = /document/;
			scripts[13] = /DOCUMENT/;
			scripts[14] = /cgi/;
			scripts[15] = /CGI/;
			scripts[16] = /location/;
			scripts[17] = /LOCATION/;
			scripts[18] = /http/;
			scripts[19] = /HTTP/;
			scripts[20] = /,/;
			scripts[21] = /</;
			scripts[22] = />/;
			scripts[23] = /-/;
			scripts[24] = /_/;
			scripts[25] = /"/;
			scripts[26] = /;/;
			scripts[27] = /:/;
			scripts[28] = /!/;
			scripts[29] = /@/;			
			scripts[30] = /%/;
			

			
			
	for(var i=0; i<scripts.length; i++)
		{
			
			if (scripts[i].test(obj))
			  {
				alert("Injection characters found." );
				obj="";
				//obj.focus();
				return false ; 
			   }
		   		
		}// end for
		return true;
	}// end fuction