Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've got html / javascript code on my site like this:

<a onclick="validateForm('formEdit',...,'submitpage(&quot;mypaymentsettings&quot;,&quot;320&quot;)','show_confirmation_message()','conf1');" href="#"><span>Save</span></a>

I'm trying to understand if there's a way I can call this function "submitpage()" directly from another site.

I can submit POST requests from elsewhere, just wondering if javascript can be accessed similarly or not.

share|improve this question
up vote 3 down vote accepted

I can just include your javascript file on my page like this:

<script type="text/javascript" src=""></script>

This would allow me to reuse your submitpage() function from my page.

share|improve this answer
would this "execute" on the "target" site's server or on mine? – Steve Feb 10 '11 at 6:26
Javascript is always executed on the clients not on the server. The script would however be downloaded from your site, but only run in the browser of the client. Remember that anything stored on clients, like javascript, can be modified by the clients to do exactly their liking. So any validation or similar can be easily broken and bypassed just by modifying the html and javascript on the client. – Chris Dale Feb 10 '11 at 9:03
I think @Steve's question was referring more to Same-Origin Policy, where it very much matters the context of which server the script was downloaded from. – AviD Feb 10 '11 at 11:06

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.