Any way to execute inline javascript as a URL?

Question

In many browsers you can do something like this:

javascript: alert("...");

Is there any way to combine that with a url? I'm thinking of something like this:

http://example.com?javascript: alert("...");

The effect would be that the javascript would be executed after the page is loaded (same effect as loading the URL and then entering the above javascript statement)

Edit: I can't use window.onload or anything like that because I don't necessarily own the page.

Answer 1

No you can't do that. If you could it would represent a security problem as you could run arbitrary Javascript on another domain's page, which is what XSS ("cross-site scripting") is all about.

Basically any Javascript that runs on the new page has to be on the new page.

Edit: The difference between executing Javascript on the current page and on some arbitrary other page is huge. On the current page, by definition you have access to it so you can run anything you want. There is no security risk inherent with that. But what if you could execute arbitrary code on another page?

It would allow you to do this:

• force the user to a banking Website;
• retrieve their cookie on that site (you can do that with JS); and
• redirect that user with to a malicious Website passing the cookie as a query parameter.

That's why you can't.