The following table describes changes between Microsoft Internet Explorer 6 and Windows Internet Explorer 8.
| Design changes from Internet Explorer 6 to Internet Explorer 7 | Design changes from Internet Explorer 7 to Internet Explorer 8 |
|---|
| Internet Explorer versioning | Check for code that incorrectly special cases around Internet Explorer 6, Windows Internet Explorer 7, or Internet Explorer 8 through user-agent string sniffing, versions vectors, or conditional comments. |
- When a long User Agent (UA) String encounters a server that accepts only shorter UA Strings, users see an error page.
|
- The Compatibility View in Internet Explorer 8, which is turned on by default for intranet sites, sends a Internet Explorer 7 user agent string. To differentiate between Internet Explorer 7 and Compatibility View, look for the new Trident token.
|
|
Standards compliance updates
| Quirks mode exception: You do not need to make standards compliance changes for webpages that specify the quirks mode DOCTYPE (by setting the “standards-compliance” DOCTYPE switch to “off”). |
| Applies to Internet Explorer 7 Standards or “Strict” mode and above:
| Applies to Internet Explorer 8 Standards mode and above:
-
Unclosed P elements are automatically closed when they are followed by TABLE, FORM, NOFRAMES, or NOSCRIPT elements.
- Malformed HTML is not supported, in favor of well-formed, valid markup.
- The "className" attribute syntax is not supported, in favor of “class” syntax.
- The attributes collection does not contain all possible attributes that Windows Internet Explorer recognizes.
- Attribute ordering has changed, affecting attributes collection, innerHTML, and outerHTML.
- GetElementById is case-sensitive and does not search name attributes.
- Generic CSS prefix selectors (that is, v\:* syntax) are not supported, in favor of explicit tag names.
- CSS expressions are not supported, in favor of improved CSS support or DHTML logic.
- Code that is intended for custom JSON object methods might conflict with the new native JSON object in Internet Explorer 8.
- Unset initial properties on the currentStyle object return their initial value.
- Unspecified properties values on the currentStyle object style object return an empty string (for example, see the ASP.NET Menu and IE8 rendering white issue blog post).
|
|
|
Security improvements
- Apply regardless of document mode.
- You can turn off security features by using Group Policy.
|
|
- XSS filter is on by default, which blocks script patterns that most frequently resemble Type-1 XSS attacks, unless you disable them through a X-XSS-Protection HTTP header.
- Cross-domain, cross-document communication hacks like SCRIPT SRC are not supported, in favor of safer XDM and XDR AJAX features.
- AJAX-enabled sites that manually manipulate the hash of the URL might be broken by the new window.location.hash navigation property.
-
New AJAX features like XDM have native properties that might conflict with existing custom properties.
- File upload control submits only the file path, not the full path, to the server.
- HTML code or script that is delivered with an "image/*" MIME type is blocked from executing.
-
Navigating a top-level frame to a site in a different security context opens a new window or tab instead of navigating within the existing frame.
-
UTF-7 encoded script is forced into Windows-1252 encoding, which might cause plain text rendering.
- HTTP/HTTPS "mixed mode" pages display a dialog box that defaults to displaying secure items only (versus the previous nonsecure default). Users might mistakenly choose to block HTTP elements, like key images.
- DEP/NX is on by default, which blocks certain add-ons (that is, ActiveX controls and COM objects) that are built by using older versions of ATL from running code that is marked "non-executable" in memory.
-
Content that is returned by a web proxy is blocked if an SSL tunnel is not established in response to a CONNECT request to the original server.
|
Architectural changes
- Apply regardless of document or compatibility mode.
|
|
-
Protected Mode Update: Intranet runs in medium (instead of low) integrity level by default.
- Loosely Coupled Internet Explorer might block add-ons (that is, ActiveX controls and COM objects) that do one of the following:
- Use windows hierarchy techniques to locate UI frame and tab windows (which now run in separate processes at different integrity levels).
- Create a subclass of the UI frame (now at medium integrity level) from a low-integrity tab process.
- Use unsupported messaging techniques between UI frame and tabs.
|
