1. Local HTTP server

From JavaScript, send AJAX request containing your command to local HTTP server. All modern browsers support cross-domain AJAX. The server can pass command as a parameter to the batch file. Make sure that the server is not accessible from network.

The advantage of this approach is that you can send response from command back to JavaScript.

• JavaScript:

  $.post('http://localhost:8080', {command: '...'});
  

• Bottle.py server:

  #!/usr/bin/python
  from bottle import run, route, request, response
  import subprocess
  
  @route('/', method='POST')
  def index():
      command = request.POST['command']
      result = subprocess.check_output(['batchfile.bat', command], shell=True)
  
      response.set_header('Access-Control-Allow-Origin', '*')
      return result
  
  run(host='localhost', port=8080, reloader=True)
  

• Or PHP under Apache/nginx:

  $result = shell_exec("batchfile.bat " . escapeshellarg($_POST['command']));
  

• Or daemon in PHP:

  For extra fun it has full shell access and can run commands asynchronously, which allows to launch desktop applications without blocking. It doesn't need Apache.

  Start: php.exe -f batrunner_daemon.php

  Use: $.get('http://localhost:33333/ping -h', function(response) { console.log(response) });

  $host = '127.0.0.1';
  $port = 33333;
  $async = false; // enable to run commands without blocking the server (useful for GUI applications)
  
  $socket = socket_create(AF_INET, SOCK_STREAM, SOL_TCP);
  $open = @socket_bind($socket, $host, $port);
  if ($open) {
      echo "\nListening on http://{$host}:{$port}";
  } else {
      echo "\nError. Port {$port} in use";
      exit;
  }
  socket_listen($socket, 1);
  
  while(1) {
      $connection = socket_accept($socket);
      $http_request = socket_read($connection, 32768);
      $command = rawurldecode(substr(strstr($http_request, "\r\n", true), 5, -9));
  
      echo "\nRunning: {$command}...";
  
      if ($async) {
          $response = pclose(popen('start "" /B ' . $command, 'r')) ? 'error' : 'success';
      } else {
          $response = shell_exec($command);
      }
  
      echo " Done.";
  
      socket_write($connection, implode("\r\n", array(
          'HTTP/1.1 200 OK',
          'Content-Type: text/plain; charset=UTF-8',
          'Connection: close',
          'Content-Length: ' . strlen($response),
          'Access-Control-Allow-Origin: *',
          "\r\n" . $response
      )));
      socket_close($connection);
  }
  

  To keep it simple, it doesn't have proper error handling and allows any site to execute anything on your computer, use at your own risk.

  Access-Control-Allow-Origin: * means that any site can receive response from shell. Without this header they obviously still can run commands, but can't receive response.

2. URI Scheme

I experimented with @mamdrood's idea, and it turned out to be very simple, much easier than HTTP server.

• From HTML, you'll be able to call the batch file like this:

  <a href="batrunner://somecommand">Wipe all files</a>
  

• And here's how the batch file in C:\mybatfile.bat can parse commands:

  @echo off
  SET command=%1
  SET command=%command:batrunner://=%
  echo %command%
  

  I'm not very familiar with batch files, and my command name parsing code can be vulnerable. If you know any better please update this answer.

• To associate your batch file with batrunner:// protocol create batrunner.reg and run it once. Substitute C:\\mybatfile.bat for your script, path should be escaped.

  Windows Registry Editor Version 5.00
  
  [HKEY_CLASSES_ROOT\batrunner]
  "URL Protocol"=""
  
  [HKEY_CLASSES_ROOT\batrunner\shell]
  
  [HKEY_CLASSES_ROOT\batrunner\shell\open]
  
  [HKEY_CLASSES_ROOT\batrunner\shell\open\command]
  @="C:\\mybatfile.bat %1"