Re: <script src=javascript:"..."> should do nothing

Toby A Inkster wrote:
> This is nasty, I know, but what about:
> 
> <script src="javascript:return 'window.alert(&quot;hello&quot;)';">
> </script>

Other than the misplaced |return| statement, this can certainly be made 
to work, subject to UA security restrictions.

The question is why you'd care to make this work, of course...  There is 
no use case I can think of here.

-Boris

Received on Monday, 11 August 2008 18:09:40 UTC