The XMLHttpRequest object is native in IE7 and is prefered to use but if your code is creating the ActiveX version of the XHR-object then make sure you do not initiliaze version 5.0 as it is not marked as safe in IE7. All previous versions are marked as safe and the user is not prompted with the security bar to allow the object.
Example that will bring up the security bar:
var oXML, XMLParserList = new Array ( "Microsoft.XMLHTTP", "MSXML2.XMLHTTP", "MSXML2.XMLHTTP.3.0", "MSXML2.XMLHTTP.4.0", "MSXML2.XMLHTTP.5.0" );
for ( var i = XMLParserList.length; i>0;i--) {
try {
// Test for MSXML obj
alert( XMLParserList[i-1] );
oXML = new ActiveXObject( XMLParserList[i-1] );
break;
}
catch(e) {}
}