Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I've got html / javascript code on my site like this:

<a onclick="validateForm('formEdit',...,'submitpage(&quot;mypaymentsettings&quot;,&quot;320&quot;)','show_confirmation_message()','conf1');" href="#"><span>Save</span></a>

I'm trying to understand if there's a way I can call this function "submitpage()" directly from another site.

I can submit POST requests from elsewhere, just wondering if javascript can be accessed similarly or not.

share|improve this question
add comment

1 Answer

up vote 3 down vote accepted

I can just include your javascript file on my page like this:

<script type="text/javascript" src="http://www.yourhomepage.com/xxx.js"></script>

This would allow me to reuse your submitpage() function from my page.

share|improve this answer
    
would this "execute" on the "target" site's server or on mine? –  Steve Feb 10 '11 at 6:26
1  
Javascript is always executed on the clients not on the server. The script would however be downloaded from your site, but only run in the browser of the client. Remember that anything stored on clients, like javascript, can be modified by the clients to do exactly their liking. So any validation or similar can be easily broken and bypassed just by modifying the html and javascript on the client. –  Chris Andrè Dale Feb 10 '11 at 9:03
    
I think @Steve's question was referring more to Same-Origin Policy, where it very much matters the context of which server the script was downloaded from. –  AviD Feb 10 '11 at 11:06
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.