3 ms·
What you're referring to is a self-XSS. They were a lot more common back when you could run JavaScript from the address bar. These days if you try and paste Ja
by underwater 14y ago
What you're referring to is a self-XSS. They were a lot more common back when you could run JavaScript from the address bar.
These days if you try and paste JavaScript to your address bar (try it with: javascript:alert(1);) then the browsers try and stop you. Firefox just won't execute any JavaScript, even if you've manually typed it. IE and Chrome strip the "javascript:" prefix (but Chrome is vunerable if you type "j" and paste the remainder).
More info here: https://www.facebook.com/photo.php?v=956977232793 https://www.facebook.com/photo.php?v=956977232793