Is it possible to set a javascript variable through the URL?

Here's an example of the code I'm trying to modify:

<script type="text/javascript">

var x = 0;


Is there a way to modify that variable through a browser, for instance, www.somewebsite.com + (something that changes 'x' variable)?

Related on Stack Exchange:https://stackoverflow.com/questions/39023761/modify-javascript-variable-with-url

2 Answers 2


No, this is not possible without an XSS vulnerability. If such a thing were generally possible, XSS would run rampant and you could execute any arbitrary code on any page, which would be bad.

Now if the code had a reflected XSS attack vector, or an DOM-based XSS attack vector, the the URL could be used to deliver a JavaScript payload. Of course, this would only be possible if the server-side or JavaScript code had such a security vulnerability (if your code makes that possible, then you should fix it).


Similar attacks are possible, without XSS.

Say the code was

<script type="text/javascript">

var x = 0;

// Some processing



If the attacker wants the value of x not to be affected by the x=395 they could use the browser's anti-XSS filter in order to filter out the code.

e.g. By creating a crafted link to send to their victim:


The XSS filter will detect that the parameter value is reflected in the output (x=395;), and block execution of it.

Therefore, the original value of x will remain.

In order to mitigate this, set the user's browser's XSS filter to block rather than to filter using security headers:

X-XSS-Protection: 1; mode=block

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .