jQuery

In short: A fast, small JavaScript library that simplifies HTML DOM traversal and manipulation, event handling, animation and AJAX with a concise, chainable API that worked consistently across browsers (especially old IE).

• It also had a large plugin ecosystem.
• Modern browsers now offer standard APIs (querySelector, fetch, classList), so new projects often don't need it, but many existing apps still do.

In short: $(document).ready() (or $(fn)) runs as soon as the DOM is parsed and ready to manipulate, before images and stylesheets finish loading;

• you can have many ready handlers.
• window.onload (or $(window).on("load")) waits until all resources, including images and iframes, have loaded — later.
• Use ready for DOM setup, load for things needing image dimensions.

In short: $ is an alias for the jQuery function, used to select elements, create elements and run code on DOM ready.

• Other libraries (old Prototype.js) also use $;
• jQuery.noConflict() releases $ back to them, and you can use jQuery(...) or wrap your code in (function ($) { ... })(jQuery) to keep using $ locally.

In short: .text() gets/sets the text content (HTML-escaped, safe for user input).

• .html() gets/sets inner HTML (parses markup — XSS risk with untrusted data).
• .val() gets/sets the value of form elements (input, select, textarea).

In short: .bind() attached handlers directly to existing elements;

• .live() attached to the document for current and future elements (removed in 1.9, slow);
• .delegate() attached to a chosen ancestor for matching descendants.
• .on() (1.7+) unified all of them: .on("click", handler) for direct binding and .on("click", ".child", handler) for delegation.
• Use .on()/.off() only.

In short: Binding a handler to a static ancestor with a selector argument — $("#table").on("click", ".delete", fn) — so events bubbling from matching descendants are handled.

• It works for elements added dynamically after binding (e.g. rows inserted via AJAX) and uses one handler instead of hundreds.

In short: .attr() works with HTML attributes as written in markup (initial values, strings).

• .prop() works with DOM properties reflecting the current state (booleans like checked, disabled, selected).
• E.g. after a user ticks a checkbox, .prop("checked") is true but .attr("checked") may still be undefined.
• Use .prop for boolean state since jQuery 1.6.

In short: $.ajax({ url, method, data, contentType, dataType }) or shortcuts $.get, $.post, $.getJSON, .load().

• They return jqXHR objects implementing the Deferred/Promise interface: chain .done(), .fail(), .always(), .then(), and combine with $.when() for parallel calls.
• Since 3.0 deferreds are Promises/A+ compatible, so they can be awaited.
• For ASP.NET Core POSTs, send the antiforgery token in a header.

In short: The handlers were bound directly ($(".delete").on("click", ...)) to rows existing at bind time; new rows don't have them.

• Use delegation on a static container: $("#ordersTable").on("click", ".delete", handler) — or rebind after each refresh (worse).
• Make sure the container itself isn't replaced by the AJAX refresh.

In short: Upgrade to the latest jQuery 3.x/4.x (3.5+ fixed the htmlPrefilter XSS issues), using jQuery Migrate in development to find deprecated API usage and fix it (e.g. .size(), .bind(), .success() callbacks);

• update plugins to compatible versions;
• review code that passes user data into .html(), .append() with strings or $(userInput) and switch to .text()/element creation;
• add a Content-Security-Policy;
• retest the UI.