152

Is it possible to call a javascript function from the URL? I am basically trying to leverage JS methods in a page I don't have access to the source.

Something like: http://www.example.com/mypage.aspx?javascript:printHelloWorld()

I suspect the answer to this is no but, just wondered if there was a way to do it.

6
  • 4
    What behaviour would your URL have to display - do you want to execute Javascript in the context of that site? Commented Nov 12, 2010 at 10:54
  • 1
    The http: at the start of the URI tells the browser "I want you to make an HTTP request", so HTTP request it does. There is no way around it, I think. Commented Nov 12, 2010 at 11:29
  • 10
    If I paste javascript:alert("Hi"); into my Firefox (28.0) address bar and press Enter, nothing happens. Maybe this has been disabled? ... Yes, apparently it has been disabled because idiots could be convinced to paste anything into their address bar. Found the info here: stackoverflow.com/a/18782801/111036 Commented Apr 6, 2014 at 11:11
  • 2
    copy paste doesn't work, but if you type it, it works, looks like it not disabled, but parsed when pasted. Commented May 15, 2017 at 7:09
  • 2
    Note: it only works in Firefox when 1. you're on an actual (not empty) page and 2. you explicitly put "javascript:" before it. Commented Jun 19, 2017 at 22:52

14 Answers 14

77

There isn't from a hyperlink, no. Not unless the page has script inside specifically for this and it's checking for some parameter....but for your question, no, there's no built-in support in browsers for this.

There are however bookmarklets you can bookmark to quickly run JavaScript functions from your address bar; not sure if that meets your needs, but it's as close as it gets.

Sign up to request clarification or add additional context in comments.

1 Comment

I am basically trying to leveradge JS methods in a page I dont have access to the source.
50

You can use Data URIs. For example: data:text/html,<script>alert('hi');</script>

For more information visit: https://developer.mozilla.org/en-US/docs/Web/HTTP/Basics_of_HTTP/Data_URIs

6 Comments

i always thought data url is only for images, thanks this is really amazing :)
you can't append this to a url.
Some browsers may block this with a message: Navigation to toplevel data: URI not allowed (Blocked loading of: “data:text/html,<script>alert('hi');</script>”)
It works on Google Chrome Version 80.0.3987.132 (Official Build) (64-bit).
Before you get too excited - this will not execute on the current page. It will load a blank document and run JS in that context.
|
46

Write in address bar

javascript:alert("hi");

Make sure you write in the beginning: javascript:

5 Comments

It doesn't work on Google Chrome Version 80.0.3987.132 (Official Build) (64-bit). Chrome automatically strips the javascript: prefix from the address bar.
@stomy You need to type javascript: manually, unfortunately
@wjandrea You can, however, create a bookmark (you still have to manually type the prefix) and it will execute the Javascript when you click on it. I've made some pretty neat stuff this way; I believe I heard from somewhere that these are called Bookmarklets.
Is it possible that this doesn't work anymore?
it works, be sure to type javascript:
8

/test.html#alert('heello')

test.html
<button onClick="eval(document.location.hash.substring(1))">do it</button>

3 Comments

Note that this evaluating user input is very dangerous practice and should usually not be allowed.
Yes, this is quite insane. There are workplaces where you would get fired because of this type of insanity.
This leads to reflected cross-site scripting (XSS) issues as pointed out by @domenukk.
7

About the window.location.hash property:

Return the anchor part of a URL.


Example 1:

//Assume that the current URL is 

var URL = "http://www.example.com/test.htm#part2";

var x = window.location.hash;

//The result of x will be:

x = "#part2"

Exmaple 2:

$(function(){   
    setTimeout(function(){
        var id = document.location.hash;
        $(id).click().blur();
    }, 200);
})

Example 3:

var hash = "#search" || window.location.hash;
window.location.hash = hash; 

switch(hash){   
case "#search":  
    selectPanel("pnlSearch");
    break;    
case "#advsearch":    

case "#admin":  

}

Comments

6

you may also place the followinng

<a href='javascript:alert("hello world!");'>Click me</a>

to your html-code, and when you click on 'Click me' hyperlink, javascript will appear in url-bar and Alert dialog will show

3 Comments

javascript will appear in url-bar in what browser? I have never seen that. (I know javascript: links work, I'm just talking about the URL bar)
Neither have I. I know you can type JS into the address bar
This is what I was looking for, whats this called?
3

Using Eddy's answer worked very well as I had kind of the same problem. Just call your url with the parameters : "www.mypage.html#myAnchor"

Then, in mypage.html :

$(document).ready(function(){
  var hash = window.location.hash;
  if(hash.length > 0){
    // your action with the hash
  }
});

Comments

3

Just use:

(function() {
  var a = document.createElement("script");
  a.type = "text/javascript";
  a.src = "http://www.example.com/helloworld.js?" + Math.random();
  document.getElementsByTagName("head")[0].appendChild(a)
})();

This basically creates a new JavaScript line in the head of the HTML to load the JavaScript URL you wish on the page itself. This seems more like what you were asking for. You can also change the a.src to the actual code, but for longer functions and stuff it becomes a problem. The source link can also link to a JavaScript file on your computer if targeted that way.

Comments

2

you can use like this situation: for example, you have a page: http://www.example.com/page.php then in that page.php, insert this code:

if (!empty($_GET['doaction']) && $_GET['doaction'] == blabla ){
echo '<script>alert("hello");</script>';
}

then, whenever you visit this url: http://www.example.com/page.php?doaction=blabla

then the alert will be automatically called.

Comments

1

No; because it would make links extremely dangerous.

Comments

0

There is a Chrome extension called Bookmarklet URL (no affiliation). To append a URL with JavaScript, so that the JavaScript command is executed just after loading the webpage, one can use ?bmlet=javascript:

Example: Display an alert box

https://github.com/?bmlet=javascript:alert("Hi");

Example: Enable spell-checking while editing a GitHub README file
[Obviously, a spelling checking extension must be originally available.]

https://github.com/<username>/<repositoryname>/edit/main/README.md?bmlet=javascript:document.getElementById("code-editor").setAttribute("spellcheck","true");

On some pages, it might take some time, as the JavaScript command runs after completely loading the page. Simple commands like alert("Hi"); should run quickly.

Comments

-1

you can execute javascript from url via events Ex: www.something.com/home/save?id=12<body onload="alert(1)"></body>

does work if params in url are there.

2 Comments

It looks like you have tested with an unsecure site which is prone to XSS attack.
lol i hope this is not your own site because if this works then that site is very insecure.
-1

You might use this:

data:text/html,<script>location.href ="https://www.google.com";alert("hello world")</script>

2 Comments

That creates an entirely new page and then runs JS in it. The JS does not have access to the methods in the page that the question is asking about.
It's also a duplicate of an existing answer: stackoverflow.com/a/39376992/19068
-2

You can do one thing that is you can first open the link www.example.com. Then you can search: javascript:window.alert("Hello World!")

2 Comments

Your answer could be improved with additional supporting information. Please edit to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers in the help center.
That's like saying "You can open www.example.com and then click on the button that runs the js". It's not what OP wants

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.