1. Browsers can only run JS inside application/javascript files. 2. Browsers will ignore any 'on' attributes. 3. HTML may link to JS with one or more LINK tag

1. Browsers can only run JS inside application/javascript files. 2. Browsers will ignore any 'on' attributes. 3. HTML may link to JS with one or more LINK tags. 4. JS may assign 'on' attribute event handlers to individual HTML tags. 5. JS will have access to only the cookies of domain hosting the JS file. There's still a risk of bad LINK tags creeping in, but the code will only be able to see the cookies of the domain hosting the dodgy JS.