Suggestions

[Petie]

Either I or you misunderstand something here. I believe SWF files are just like JS files in this regard. They just get downloaded and their codes run on client side.

You're right. The SWF does download and run on the client side. Re-reading what I wrote, I suppose I did overthink it a bit since the requests the SWF makes would be the same, in essence, as those made by JavaScript. The rest of what I said still holds, though I think the security holes in Flash generally affect the client side, not the server, so this is likely less of a concern than I initially implied. I updated my original post to reflect this.

Well, this concern is understandable but I have to warn, HTML5 never guarantees perfect compatibility either. Some browsers/devices may not be able to handle properly so at the end of the day, there's no absolute solution for all here. Still I hope someone can make one in HTML5.

You're not wrong here either. However, while HTML5 does not guarantee perfect compatibility, Flash guarantees no compatibility with mobile devices so the HTML5 route is still a better option if it can be done.